The password was designed for a world where the main threat was someone at the next desk guessing it. It now defends against automated attacks testing billions of leaked credentials per day — a job it was never built for and demonstrably cannot do. Understanding how passwords fail explains exactly what MFA adds, and why it's the single highest-value security control an ordinary person or organisation can switch on.
How passwords actually get beaten
- Breaches and reuse — the big one. Some website you registered on years ago gets breached; your email-and-password combo joins a public list; attackers replay that combo against email providers, banks, and employers. This is credential stuffing, and it works because most people reuse passwords. Your password's real strength is the security of the worst website you ever used it on.
- Phishing — you type the real password into a fake page. Complexity is irrelevant; you handed it over.
- Guessing at scale — automated tools trying millions of common patterns. "Summer2024!" satisfies every complexity rule and falls in seconds.
The three factors
Authentication evidence comes in three species: something you know (password, PIN), something you have (your phone, a hardware key), and something you are (fingerprint, face). Multi-factor authentication means requiring evidence from at least two different species. The logic is beautifully simple: an attacker on another continent can steal what you know — databases leak, people get phished. Stealing what you hold at the same time requires a fundamentally different, usually physical, attack. One theft stops being enough to become you.
Not all second factors are equal. SMS codes are far better than nothing but inherit phone-network weaknesses (SIM-swap attacks). Authenticator apps are meaningfully stronger. Push notifications are convenient but enabled "MFA fatigue" attacks — bombarding a user with prompts until they tap approve, which is how some very famous companies got breached. Hardware keys and passkeys sit at the top, because they verify the website's identity too, making them effectively phishing-proof.
Where this lands practically
For personal accounts: a password manager (unique random passwords everywhere, killing credential stuffing) plus MFA on anything that matters — email above all, because email resets everything else. For work: this is why IT enforces MFA and why security teams treat "MFA not enabled" findings as urgent. The stat you'll see quoted in every vendor deck — that MFA blocks the overwhelming majority of automated account attacks — is roughly honest. Few controls buy so much protection for so little effort.