Identity, passwords and multi-factor sign-in
Lesson 6 of 6
6Identity, passwords and multi-factor sign-in
The big pictureWhen people work from anywhere, there is no longer an "inside the company" protected by a wall. The user account became the front door: whoever has your password and code walks in as you. That is why identity is the new security boundary.
What the picture shows: Each step is harder for the attacker than the one below. A password alone sits at the bottom; FIDO2 passkeys sit at the top because they never work on a fake domain.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
A password is your house key. If you use the same key for your home, car and office, stealing it in one place opens everything. So: a different key for every door (a password manager remembers them), and a second lock that only opens with your phone (MFA). A passkey is a smart key that only fits your real door, so if a scammer shows you a fake door it simply will not work.
Factors: knowledge, possession, inherence. Password strength is measured by entropy (bits = length × log2 of the alphabet size), valid for random passwords only. NIST SP 800-63B prefers length over complexity, forbids forced periodic changes without cause, and asks for checks against breached lists. MFA, roughly in order: SMS, TOTP, push with number matching, then phishing-resistant FIDO2/WebAuthn. Storage: Argon2id, scrypt or bcrypt with a unique salt, never SHA-256 alone. At company level: IAM, SSO over SAML or OpenID Connect, least privilege, and privileged access management (PAM).
Before You Start
🎣Phishing and social engineering
You know how passwords get stolen by phishing.
The Core Idea
1Three authentication factors
You prove who you are with one or more of three: something you know (password, PIN), something you have (phone, security key), and something you are (fingerprint, face). Multi-factor authentication (MFA) combines two different factors; two passwords are not MFA because they are the same kind.
2What makes a password strong?
Attackers do not guess by hand; they try billions of options a second if they steal a file of passwords hashed with a fast function. Strength depends on the number of possibilities, and length raises it faster than adding symbols. Try it yourself:
Drill: how long does a password survive guessing?
Do not type your real password; there is nowhere to type it anyway. Pick only the length and the kinds of characters. The maths assumes a fully random password; human ones like Ahmad2024! are far weaker, because attackers try common patterns first.
A password of random characters
A passphrase of random words
Each word is drawn at random from a list of 7,776 (the Diceware method), about 12.9 bits a word. Example: orbit-velvet-cactus-ninety-lamp
Notice that 16 lowercase letters beat 8 mixed characters. Change the numbers and run.
import math
def bits(length, alphabet):
return length * math.log2(alphabet)
print(f"8 chars, letters+digits+symbols: {bits(8, 95):.0f} bits")
print(f"16 chars, lowercase only: {bits(16, 26):.0f} bits")
print(f"5 random Diceware words: {bits(5, 7776):.0f} bits")
guesses_per_second = 1e11
for name, b in [("8 mixed", bits(8, 95)), ("5 words", bits(5, 7776))]:
years = 2 ** (b - 1) / guesses_per_second / 3.156e7
print(f"{name}: about {years:,.2f} years on average")P@ssw0rd2024! is strong because it has every kind of character. It is a human pattern attackers try in the first minute. Randomness and length are what count.3MFA and passkeys
Not all second factors are equal. SMS is better than nothing but can be stolen by SIM swaps and phishing. An authenticator app is stronger. Push with number matching stops blind approvals when an attacker floods you with requests. And passkeys, built on FIDO2, are the only phishing-resistant option: a private key that stays on your device, is never sent, and is bound to the site's domain.
4How a server stores passwords
A decent site does not know your password. It stores its hash using a deliberately slow function like Argon2id or bcrypt, with a salt added first: a random value unique to each user. The slowness makes guessing expensive, and the salt makes two identical passwords produce different hashes and defeats precomputed tables.
At company level: single sign-on (SSO) means one strong account with MFA instead of dozens of weak ones, and least privilege means nobody holds admin rights except when needed.
Worked example
The task: a site stores passwords with SHA-256 and no salt. What is wrong, and what is the fix?
The answer: SHA-256 is very fast, so if the database is stolen the attacker can try billions of guesses a second. No salt means identical passwords have identical hashes and precomputed tables work. The fix: Argon2id or bcrypt with a unique salt per user, re-hashing each password the next time its owner signs in, and forcing resets if there was a leak.
Myth vs Reality
| Myth | Reality |
|---|---|
| Changing your password every month makes it stronger. | Forced frequent changes push people into predictable patterns. What matters is length, uniqueness per site, and changing on suspicion. |
| A password manager is risky: all eggs in one basket. | The basket is guarded by a strong master password and MFA; the realistic alternative is one reused password everywhere, which is far worse. |
Where you meet it at work
🏠At home
You install a password manager and turn on MFA for email and bank this week.
🧑💻Developer
Stores passwords with Argon2id and adds passkey support to their app.
🏢Identity admin
Connects apps to SSO and reviews high privileges every quarter.
Test your understanding
Which sign-in method is phishing-resistant?
FIDO2 is bound to the real site's domain, so it does not work on a fake page.
The right way to store passwords in a database:
We need a slow function made for passwords with a unique salt, not reversible encryption and not a fast hash.
A password and then a second password: is that MFA?
MFA means two different factors, such as something you know and something you have.
Which sign-in method resists phishing best?
The key is bound to the real site, so it does not work on a fake one.
Why add a "salt" before hashing a password?
The salt is random per user and stored next to the hash.
Quick review cards
Check Your Understanding
Why secure your email before any other account?
Because "forgot password" on every site sends the reset link to email; whoever owns it owns the rest.
Why is the calculator's number too high for something like Ahmad2024?
Because it assumes full randomness, while attackers try names, years and common patterns first.
Why does a unique password per site matter more than one complex password?
Because one site leaking exposes the password, and attackers try it on your other accounts (credential stuffing).
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.