Password hygiene + MFA
What you'll learn
- Password manager + unique random passwords for every account.
- MFA via app or hardware key; SMS only as last resort.
- Never read an MFA code aloud or paste it into an unfamiliar form.
Use a password manager for every account, generate unique high-entropy passwords (16+ chars, random), and never reuse them. The dominant breach vector for individuals is credential stuffing — attackers replay a password leaked in one breach against every other account that might share it.
MFA: prefer authenticator app or hardware key over SMS. SMS MFA is better than no MFA but is vulnerable to SIM-swap. Hardware keys (FIDO2/WebAuthn) are the gold standard because they bind the credential to the origin and resist phishing.
Never share an MFA code. If someone — even "IT" — calls and asks you to read your code aloud, the call is the attack. Legitimate support will never ask for the code; legitimate password resets never require it from another person.
Key points
- Password manager + unique random passwords for every account.
- MFA via app or hardware key; SMS only as last resort.
- Never read an MFA code aloud or paste it into an unfamiliar form.
Pitfalls
- Reusing 'just one' password — the one most likely to be in a breach dump.
- Approving an MFA prompt you didn't initiate ('MFA fatigue' attack).
Ask your security team
In a real Adept rollout this routes to your company's security Claude project; in the demo it opens a fresh Claude chat.