{"id":3813,"date":"2026-11-01T15:23:01","date_gmt":"2026-11-01T23:23:01","guid":{"rendered":"https:\/\/cyber.mag212.com\/learn\/passwords-mfa\/"},"modified":"2026-11-01T15:29:05","modified_gmt":"2026-11-01T23:29:05","slug":"passwords-mfa","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/learn\/passwords-mfa\/","title":{"rendered":"Passwords, Passkeys &#038; MFA: What Actually Works"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-passwords-mfa\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Learn \u00b7 Security<\/div>\n<h2>Passwords, passkeys &amp; MFA: <span>what actually works.<\/span><\/h2>\n<p>Most password advice people remember is out of date. Here are the current rules from NIST and CISA, how to build passwords you can remember, and which kinds of multi-factor authentication (MFA) really stop attackers.<\/p>\n<div class=\"toc\"><a href=\"#rules\">The modern rules<\/a><a href=\"#passphrase\">Passphrases<\/a><a href=\"#manager\">Password managers<\/a><a href=\"#mfa\">MFA, ranked<\/a><a href=\"#passkeys\">Passkeys<\/a><a href=\"#admins\">For IT admins<\/a><\/div><\/section>\n\n<section class=\"sec\" id=\"rules\"><h3>The modern password rules<\/h3>\n<p>NIST Special Publication 800-63B-4, finalised in 2025, is the reference most organisations follow. It replaced complexity theatre with rules based on how passwords are really attacked.<\/p>\n<table><tbody><tr><th>Old habit<\/th><th>Current guidance (NIST SP 800-63B-4)<\/th><\/tr>\n<tr><td>8 characters with upper, lower, digit and symbol<\/td><td>At least <b>15 characters<\/b> when the password is the only factor, at least 8 when it is used with MFA. Allow at least 64 characters.<\/td><\/tr>\n<tr><td>Forced mix of character types<\/td><td><b>No composition rules.<\/b> Length matters far more, and rules push people to predictable patterns like <code>Summer2026!<\/code>.<\/td><\/tr>\n<tr><td>Change every 90 days<\/td><td><b>No scheduled expiry.<\/b> Force a change only when there is evidence of compromise.<\/td><\/tr>\n<tr><td>Anything that passes the rules is fine<\/td><td><b>Block common and breached passwords<\/b> by checking new ones against a blocklist.<\/td><\/tr>\n<tr><td>Security questions and hints<\/td><td><b>Don&#8217;t use them.<\/b> Answers are easy to research or guess.<\/td><\/tr>\n<tr><td>Block pasting into password fields<\/td><td><b>Allow paste and password managers.<\/b><\/td><\/tr>\n<\/tbody><\/table><\/section>\n\n<section class=\"sec\" id=\"passphrase\"><h3>Passphrases you can remember<\/h3>\n<p>The easiest way to reach 15+ characters is a passphrase: several random, unrelated words. The UK NCSC popularised &#8220;three random words&#8221;; for important accounts, use four or more.<\/p>\n<ul class=\"l\">\n<li><b>Random means random.<\/b> Song lyrics, quotes, names and keyboard patterns are in attackers&#8217; wordlists.<\/li>\n<li><b>Never reuse a password.<\/b> Reuse is how one leaked website password becomes a hacked email account.<\/li>\n<li><b>Check exposure.<\/b> Services such as Have I Been Pwned tell you if your email address appeared in a known breach.<\/li>\n<li><b>Memorise only a few:<\/b> your device login, your email account and your password manager. Let the manager handle the rest.<\/li>\n<\/ul>\n<div class=\"callout\"><b>Try it:<\/b> create a strong passphrase with our <a href=\"\/tools\/password-generator\/\">password generator<\/a>, or test one with the <a href=\"\/tools\/password-checker\/\">password &amp; breach checker<\/a>.<\/div><\/section>\n\n<section class=\"sec\" id=\"manager\"><h3>Password managers<\/h3>\n<p>A password manager generates a long, unique password for every site and fills it in only on the real website, which also helps against fake login pages.<\/p>\n<ol class=\"l\">\n<li>Choose a reputable manager, built into your platform or standalone, that supports MFA and passkeys.<\/li>\n<li>Protect it with a long passphrase you don&#8217;t use anywhere else, plus MFA.<\/li>\n<li>Set up the recovery or emergency-access option so you are not locked out.<\/li>\n<li>Move your most important accounts first: email, banking, work and social media.<\/li>\n<\/ol><\/section>\n\n<section class=\"sec\" id=\"mfa\"><h3>MFA, ranked from strongest to weakest<\/h3>\n<p>Any MFA is far better than a password alone, but they are not equal. This ranking follows CISA&#8217;s guidance.<\/p>\n<table><tbody><tr><th>Method<\/th><th>Resists phishing?<\/th><th>Notes<\/th><\/tr>\n<tr><td>FIDO2 \/ WebAuthn: passkeys and hardware security keys<\/td><td><span class=\"pill p-l\">Yes<\/span><\/td><td>CISA calls phishing-resistant MFA the gold standard. The login is tied to the real website, so a fake site gets nothing usable.<\/td><\/tr>\n<tr><td>PKI smart cards<\/td><td><span class=\"pill p-l\">Yes<\/span><\/td><td>Common in government and large enterprises.<\/td><\/tr>\n<tr><td>Authenticator-app push <b>with number matching<\/b><\/td><td><span class=\"pill p-m\">Partly<\/span><\/td><td>Stops blind &#8220;approve&#8221; taps during MFA-fatigue attacks, but a convincing fake page can still relay the login.<\/td><\/tr>\n<tr><td>Authenticator-app codes (TOTP) and hardware OTP tokens<\/td><td><span class=\"pill p-m\">Partly<\/span><\/td><td>Good for most people; a real-time phishing proxy can still capture a code.<\/td><\/tr>\n<tr><td>Push approval without number matching<\/td><td><span class=\"pill p-h\">No<\/span><\/td><td>Vulnerable to push bombing. Turn on number matching.<\/td><\/tr>\n<tr><td>SMS or voice codes<\/td><td><span class=\"pill p-c\">Weakest<\/span><\/td><td>Exposed to SIM swapping and interception. Still better than no MFA.<\/td><\/tr>\n<\/tbody><\/table><\/section>\n\n<section class=\"sec\" id=\"passkeys\"><h3>Passkeys in plain language<\/h3>\n<p>A passkey replaces the password with a cryptographic key pair. The private key stays on your phone, computer or security key, unlocked by your fingerprint, face or PIN, and the website only ever stores the public key. Because each passkey works only on the site it was created for, it cannot be typed into a fake page or leaked in a database breach.<\/p>\n<ul class=\"l\">\n<li>Turn on passkeys first for your email, Microsoft, Google and Apple accounts.<\/li>\n<li>Keep at least two ways in: a synced passkey plus a security key, or saved recovery codes.<\/li>\n<li>Remove SMS as a fallback once a stronger method works, where the service allows it.<\/li>\n<\/ul><\/section>\n\n<section class=\"sec\" id=\"admins\"><h3>Checklist for IT admins<\/h3>\n<ul class=\"l\">\n<li>Set minimum length to 15 for password-only systems and screen new passwords against a breached-password list.<\/li>\n<li>Remove complexity rules and scheduled expiry; reset on evidence of compromise.<\/li>\n<li>Rate-limit failed sign-ins and alert on password spraying across many accounts.<\/li>\n<li>Require MFA for email, VPN, remote access and cloud consoles; require phishing-resistant MFA for administrators.<\/li>\n<li>Turn on number matching for push MFA and block legacy authentication protocols that cannot do MFA.<\/li>\n<li>Give every Windows machine a unique local admin password with LAPS. See our <a href=\"\/learn\/windows-hardening\/\">Windows hardening checklist<\/a>.<\/li>\n<li>Make account recovery as strong as sign-in; helpdesk resets are a favourite attacker target.<\/li>\n<\/ul>\n<p class=\"small\">Sources: NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (2025); CISA, Implementing Phishing-Resistant MFA and Implementing Number Matching in MFA Applications; UK NCSC password guidance; FIDO Alliance. Reviewed November 2026.<\/p><\/section>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<\/div>\n<style>.m212toc,.m212more{font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:#e6edf3;box-sizing:border-box}.m212toc{background:#0f1720;border:1px solid #1f2d3a;border-radius:12px;padding:14px 18px;margin:0 0 22px}.m212toc summary{cursor:pointer;font-weight:800;font-size:15px;list-style:none;display:flex;justify-content:space-between;align-items:center;gap:10px}.m212toc summary::-webkit-details-marker{display:none}.m212toc summary span{font-size:12px;font-weight:700;color:#9fb0c0}.m212toc summary::after{content:\"\u25be\";color:#3cc8f0;margin-left:auto}.m212toc details:not([open]) summary::after{content:\"\u25b8\"}.m212toc ol{margin:12px 0 0;padding:0 0 0 20px;columns:2 260px;column-gap:28px}.m212toc li{margin:0 0 6px;break-inside:avoid;font-size:14px;color:#9fb0c0}.m212toc a{color:#3cc8f0;text-decoration:none}.m212toc a:hover{text-decoration:underline}h2[id^=\"m212s-\"]{scroll-margin-top:110px}.m212more{display:flex;flex-wrap:wrap;gap:10px;margin:28px 0 8px;padding:16px;background:#0f1720;border:1px solid #1f2d3a;border-radius:12px}.m212more a{flex:1 1 200px;display:block;text-decoration:none;color:#e6edf3;background:#121c27;border:1px solid #2a3b4b;border-radius:10px;padding:10px 14px;font-size:14px;font-weight:700}.m212more a small{display:block;font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#3ee6a0;margin-bottom:2px}.m212more a:hover{border-color:#3cc8f0}<\/style><nav class=\"m212more\" aria-label=\"Keep learning\"><a href=\"\/learn\/\"><small>Back to<\/small>All learning guides<\/a><a href=\"\/learn\/phishing-guide\/\"><small>\u2190 Previous<\/small>Phishing: spot it, stop it, report it<\/a><a href=\"\/learn\/windows-hardening\/\"><small>Next \u2192<\/small>Windows hardening checklist<\/a><\/nav>\n","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBER \u00b7 Learn \u00b7 Security Passwords, passkeys &amp; MFA: what actually works. Most password advice people remember is out of date. Here are the current rules from NIST and CISA, how to build passwords you can remember, and which kinds of multi-factor authentication (MFA) really stop attackers. The modern rulesPassphrasesPassword managersMFA, rankedPasskeysFor IT admins [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3385,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3813","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3813","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3813"}],"version-history":[{"count":2,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3813\/revisions"}],"predecessor-version":[{"id":3831,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3813\/revisions\/3831"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3385"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3813"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}