Two-Factor Authentication & Account Security
Learn how two-factor authentication adds an extra layer of protection to your accounts — like having a second lock on your digital door.
📍 Where you are in the curriculum: Week 7 of 12
Welcome to Unit 3: Defending Yourself! In Unit 2, you saw how attackers use phishing, social engineering, and deepfakes to steal credentials. In Week 3, you learned to create strong passwords. Now let's add a second layer of defense so even if your password gets stolen, your accounts stay safe.
Why Passwords Alone Aren't Enough 🔓
Let's be real — you probably reuse at least a couple of passwords across different accounts. Don't feel bad; most people do. But here's why that's a massive security risk.
The Problem: Data Breaches Are Everywhere
Every year, billions of username-password combinations leak in data breaches. Companies like LinkedIn, Adobe, Twitch, and even Epic Games have been hit. When your password leaks from one site, hackers try it on every other site. This is called credential stuffing.
📊 Real stat: In 2023, over 8.2 billion passwords were exposed in data breaches worldwide. That's more than one for every person on Earth.
CISA reports ↗ that enabling MFA makes you 99% less likely to have your account compromised. That's a staggering improvement for a feature that takes minutes to set up.
The Security Triad
Authentication is built on three factors:
| Factor | What It Is | Example |
|---|---|---|
| Something you know | Information in your head | Password, PIN |
| Something you have | A physical device | Phone, security key |
| Something you are | Your biometrics | Fingerprint, face scan |
Using just a password means you're relying on ONE factor. 2FA adds a second factor, and it's one of the most effective security upgrades you can make.
How Passwords Get Compromised
- Data breaches: The company storing your password gets hacked
- Phishing: You're tricked into entering your password on a fake site
- Credential stuffing: Leaked passwords are automatically tried on other sites
- Brute force: Software guesses passwords until one works
- Keyloggers: Malware records what you type
- Social engineering: Someone manipulates you into revealing it
With 2FA enabled, none of these attacks are enough on their own. The hacker still needs your second factor.
💡 Key Takeaway: 2FA doesn't make your password less important — you still need strong, unique passwords. But it ensures that a compromised password alone isn't game over.