PathTailor
FRSign inBuild my path
PathTailor
Build my pathSign inLire en français

Passwords and Two-Factor Authentication

First lesson of the Cybersecurity: The Basics for Everyone course, free to read: about 15 minutes, 3 exercises and 3 quiz questions. This is the catalogue's base lesson; in the student space, it is rewritten for your profile.

Objectives

  • Create strong, unique passwords for every service
  • Use a password manager
  • Enable and use multi-factor authentication correctly

PasswordsPassword managerMulti-factor authentication

How passwords get stolen

Attackers usually do not need to “hack” your computer to get a password:

  • Data breaches: a website you are a customer of is hacked, and its database of credentials then circulates on the Internet.
  • Reuse: if you use the same password for that site and for your work email, the attacker simply tries the same combination elsewhere. This automated technique tests thousands of accounts in a short time.
  • Guessing: programs try the most common passwords (123456, azerty, first name + birth year, company name + 2026!).
  • Phishing: you are tricked into entering your password on a fake page (lesson 2).

A good password: long and unique

A strong password is first of all long. A simple method is the passphrase: several unrelated words, optionally separated by characters.

Weak: Paris2026!
Weak: NomDeLEntreprise1
Strong: girafe-Tonnerre-citron-7-escalier

Avoid any personal information (first names, dates, pet names) that is easy to find on social media.

Above all, every service must have its own password. This is the most important rule: it limits the damage of a breach to a single account.

The password manager

Remembering dozens of long, unique passwords is impossible. A password manager stores them in encrypted form, generates them for you, and fills them in automatically on the right site. You only remember one master password, a very strong one.

Security bonus: the manager does not autofill your credentials on a fake site whose address differs from the real one. If autofill does not work, that is a warning sign.

At work, use the manager provided or approved by your company. Notebooks, sticky notes under the keyboard, and “passwords.xlsx” files are to be avoided.

Multi-factor authentication (MFA)

MFA (or two-factor authentication) asks for a second proof in addition to the password:

  • a code or an approval in an authenticator app on your phone;
  • a physical security key;
  • a code received by SMS (better than nothing, but weaker than the previous methods).

Even if your password has leaked, the attacker cannot log in without the second proof. Enable MFA first on email, remote access, administration tools, and any account that gives access to money or sensitive data.

MFA pitfalls

Attackers adapt:

  • Notification bombing: they send dozens of approval requests hoping you will eventually tap “Approve” out of fatigue. Never approve a request you did not initiate, and report it: it means your password is known.
  • Asking for the code by phone: a fake technician calls you and asks for “the code you just received”. No legitimate service will ask you for this code. Do not share it with anyone.

In summary

Long, unique, stored in a manager, protected by MFA, never shared: these five habits block the vast majority of attacks on accounts.

Exercises

Solutions and tests stay on the server. In the student space, your code is run and checked, and the tutor gives hints before the solution.

  1. TaskDifficulty 11 hint

    Rank passwords

    Classify each of these passwords as weak or strong, and justify it in one sentence:

    No. Password
    1 Soleil2026!
    2 azerty123
    3 tortue-Violon-marche-4-glacier
    4 Dupont1985 (the user’s last name and birth year)
    5 bureau-Cerise-nuage-8-falaise, already used on three other sites
    • Passwords 1, 2, and 4 are classified as weak (short, predictable, or personal)
    • Password 3 is classified as strong (long, unrelated words)
    • Password 5 is considered one to replace because it is reused, despite its length
    • Each classification is justified

  2. TaskDifficulty 21 hint

    Personal MFA plan

    List your five work accounts (or those of a fictional sales assistant position: email, CRM, payroll tool, VPN access, company social network). For each one, indicate:

    1. whether MFA is available and enabled;
    2. the method used (app, physical key, SMS);
    3. an enablement priority (1 = urgent).
    • The five accounts are listed with their MFA status
    • Email and remote access (VPN) are priority 1
    • An app or physical key method is preferred over SMS when available

  3. Multiple choiceDifficulty 11 hint

    Unexpected notification

    At 10 p.m. you receive a notification “Do you approve this login?” even though you are not logging in. What do you do?

    • I approve it to make it stop
    • I deny it, then change my password and notify the IT department
    • I ignore it and let it ring
    • I turn off my phone

End-of-lesson quiz

  1. What is the most important rule for passwords?

    • Change one character every month
    • One unique password per service
    • Use your first name

  2. What does MFA give you if your password has leaked?

    • Nothing
    • The attacker cannot log in without the second proof
    • The password is changed automatically

  3. A “technician” asks you for the code you received by SMS. You…

    • give it if he knows your name
    • never give it and report the call
    • give it by email instead

The rest of the course

  1. Recognizing and Defeating Phishing20 min
  2. Updates, Devices, and Backups15 min
  3. Protecting Data Every Day (GDPR)15 min
  4. Responding to a Security Incident20 min
Build my pathSee the full syllabus

Cybersecurity: The Basics for Everyone · Beginner · 1 h 25 min