TryBench
Digital Safety & Security Tasks · Foundation lesson 2 of 17

Passphrases & Multi-Factor Armor

Replace weak passwords with long passphrases and upgrade from SMS OTPs to authenticator apps.

Why this matters

A strong password alone is not enough, because passwords get stolen. A second login step stops an attacker even when they have your password.

Long Passwords and a Manager

A long passphrase, like "correct-horse-battery-staple", is hard to guess. A password manager gives every account its own different password.

In real life: "Blue-mango-runs-fast-2024" is easy to remember and very hard to guess. If one site leaks it, a password manager makes sure your other accounts use different ones.

Authenticator App Beats SMS Code

Criminals can steal SMS codes with a SIM swap. An authenticator app makes the code on your own phone, so it is much safer.

In real life: SMS codes can be stolen by a SIM swap, where a criminal takes over your phone number. Authenticator apps make codes on your own device, so they are safer.

Tier 1: FIDO2 Hardware Key
Tier 2: Authenticator App (TOTP)
Tier 3: SMS OTP (vulnerable)

Your practice task

Your team is choosing a second login factor for staff accounts. Rank the three options from strongest to weakest.

How to do it

  1. Read the three defense options in the box above.
  2. Decide which is strongest, which is second, and which is weakest.
  3. Pick one answer for each rank.
  4. Press Run proof.

Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.

Quick reference: Authentication Hierarchy

Always enforce app-based TOTP or hardware keys over SMS OTP.

FIDO2 Key > Authenticator App (TOTP) > SMS OTP

Practice this lesson free

More lessons in this course

See all 17 lessons in Digital Safety & Security Tasks