PATCH//NOTES Open the interactive version
← All lessons
Defence · Beginner · 4 min

Passwords, MFA & passkeys

Identity is the new perimeter.

What it is

Attackers would rather log in than break in. Passwords get phished, guessed, reused and leaked. Multi-factor authentication (MFA) adds a second proof, but not all MFA is equal: SMS codes can be SIM-swapped, push prompts can be spammed until someone taps Approve (MFA fatigue), and fake login pages can relay codes in real time. Passkeys and hardware security keys are phishing-resistant because they only work on the real website.

See it: Why a stolen password isn't enough with MFA

  1. Attacker → Login service: Correct username and password. The password was leaked in a breach or captured by phishing.
  2. Login service → Owner's phone: Asks for a second factor. The service sends a push prompt, or asks for a code or passkey, to the real owner's device.
  3. Owner's phone → Login service: Owner doesn't approve. The owner wasn't signing in, so they ignore or deny the request. Stopped by: Number matching stops 'just tap Approve' fatigue attacks.
  4. Login service → Attacker: Access denied. Without the second factor, the password alone gets the attacker nowhere. Stopped by: Passkeys go further: they only work on the real site, so a fake page gets nothing to replay.

Step through the animated diagram in the app.

Real case · 2024

Change Healthcare

Attackers used stolen credentials on a remote access portal that didn't have MFA. The ransomware attack disrupted pharmacy and insurance payments across the US for weeks.

Source: Wikipedia: Change Healthcare

How defenders stop it

  • A password manager with unique passwords everywhere
  • Passkeys or security keys for important accounts
  • Number-matching on push MFA to stop fatigue attacks
  • Alerts on impossible travel and new device logins

Try it yourself

See which sites support 2FA

Check yourself

1. Why are passkeys considered phishing-resistant?

  1. They're longer than passwords
  2. They're tied to the real website's domain and can't be used on a fake one
  3. They change every minute
  4. They use your fingerprint
Show answer

They're tied to the real website's domain and can't be used on a fake one. The browser won't release a passkey to a look-alike domain.

2. An attacker sends push MFA prompts over and over until someone taps Approve. What's this called, and what stops it?

  1. Credential stuffing; a VPN
  2. Phishing; longer passwords
  3. Brute force; CAPTCHAs
  4. MFA fatigue; number matching on push prompts
Show answer

MFA fatigue; number matching on push prompts. MFA fatigue wears people down with prompts. Number matching means approving needs a code from the real login screen.

3. Why are SMS codes weaker than other kinds of MFA?

  1. The codes are too long
  2. An attacker can take over the phone number with a SIM swap
  3. The codes never expire
  4. Text messages are always encrypted
Show answer

An attacker can take over the phone number with a SIM swap. SMS codes can be SIM-swapped or relayed by fake login pages. Passkeys and security keys resist both.

Answer them in the app to earn XP.

Next: IoT & industrial systems →