[{"data":1,"prerenderedAt":171},["ShallowReactive",2],{"publication:en:P197":3},{"meta":4,"copy":19,"relatedArticles":135,"terms":163,"term":164,"resourceParent":165,"glossaryParent":168},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"widget":17,"preparedOn":18},"P197","\u002Fblog\u002Fwhy-passwords-fail-entropy-vs-mfa","article","why strong passwords are not enough mfa","Strong passwords, passkeys and MFA: what each protects","Password entropy, passkeys and MFA compared","Compare guessing, phishing and session theft. See when synced passkeys can meet AAL2 and what NIST requires at AAL3.",[13,14,15],"\u002Fservices\u002Faccess-2fa-audit","\u002Fblog\u002Fworkspace-mfa-setup","\u002Fblog\u002Fpassword-manager-business","2026-10-30","password-entropy","2026-11-06",{"intro":20,"sections":21,"checklistTitle":80,"checklist":81,"faq":88,"sources":98,"links":114,"cta":130},"A randomly generated password is harder to guess as its entropy increases. A phishing page can still capture a password, and malware can steal a browser session after sign-in. Choose authentication based on which of those risks you need to address.",[22,27,32,37,42,75],{"title":23,"paragraphs":24},"What entropy tells you about password guessing",[25,26],"Entropy depends on how the password was generated. Eighteen characters chosen independently from a 62-character alphabet give about 107 bits of entropy. A human-chosen string of the same length can be much easier to guess.","Online guessing depends on controls such as sign-in rate limits. Offline guessing depends on the hash or key derivation function and the resources available to the attacker.",{"title":28,"paragraphs":29},"What a Diceware passphrase protects",[30,31],"The EFF long list contains 7,776 words. Six independently selected words give about 77.5 bits of entropy. A copied example or a phrase you make up does not have the same estimate.","A passphrase can still be captured when it is entered or copied. Malware may also steal an existing browser session.",{"title":33,"paragraphs":34},"What happens when a second code arrives by email",[35,36],"Someone with access to an already signed-in inbox may be able to read sign-in or recovery codes. NIST does not allow email as an out-of-band authenticator and treats recovery separately.","A TOTP app on a separate device can limit exposure if a computer is compromised. A phishing page can still relay a code that the user enters.",{"title":38,"paragraphs":39},"How passkeys and security keys resist phishing",[40,41],"WebAuthn binds the credential to the service. A lookalike domain cannot ask the authenticator to sign in to the legitimate service with that service’s credential.","Some passkeys sync across devices. They can meet AAL2 when the deployment meets NIST requirements. AAL3 requires a non-exportable private key and other controls. A hardware security key may qualify in a compliant deployment. A stolen browser session is a separate risk.",{"title":43,"paragraphs":44,"table":45},"Compare sign-in methods and NIST assurance levels",[],{"caption":46,"headers":47,"rows":52},"How each method handles phishing and session theft",[48,49,50,51],"Method","Phishing resistance","If a browser session is stolen","NIST SP 800-63B-4",[53,58,62,66,69,72],[54,55,56,57],"Password only","Can be captured","Session can be reused","Can meet AAL1",[59,60,56,61],"Password + email code","Code can be captured","Email is not accepted as out-of-band authentication",[63,64,56,65],"Password + SMS code","Code can be relayed","Restricted method, can meet AAL2 under conditions",[67,64,56,68],"Password + TOTP","Can meet AAL2 under conditions",[70,71,56,68],"Synced passkey","Phishing-resistant sign-in",[73,71,56,74],"FIDO2 with a non-exportable key","Can meet AAL3 if all requirements are met",{"title":76,"paragraphs":77},"Choose a method for each account",[78,79],"For administrator accounts, prefer phishing-resistant sign-in. Check the authenticator and the service configuration against your requirements, and test a backup method before you need it.","Document account recovery and how to revoke sessions after a device loss. Where passkeys are unavailable, TOTP can add a second factor, with the phishing limitations above.","Account authentication resilience checklist",[82,83,84,85,86,87],"Super administrators protected with FIDO2 hardware tokens (YubiKey) plus an offline backup key","One-time sign-in codes delivered to business email are disabled across all business apps","SMS-based 2FA disabled wherever TOTP or Passkeys are supported","The team has checked which passkeys sync and which keys must stay on a device.","Emergency recovery codes printed and stored securely offline","Tested emergency workflow for session revocation and credential reset upon device loss",[89,92,95],{"question":90,"answer":91},"Why does NIST restrict authentication via SMS?","An attacker may redirect text messages by taking control of the phone number. Check for alternatives and verify the NIST requirements when using SMS.",{"question":93,"answer":94},"Is it safe to store TOTP authenticators inside the same password manager?","Keeping both secrets in one vault raises the impact of a vault compromise. For privileged accounts, consider separating them and check whether the service supports phishing-resistant sign-in.",{"question":96,"answer":97},"What happens when an employee loses their 2FA smartphone?","Recovery should rely on an administrative secondary channel: out-of-band identity verification, administrator-led credential reset via Workspace or M365 console, and immediate global session revocation.",[99,102,105,108,111],{"label":100,"url":101},"NIST SP 800-63B-4: authentication assurance levels","https:\u002F\u002Fpages.nist.gov\u002F800-63-4\u002Fsp800-63b\u002Faal\u002F",{"label":103,"url":104},"NIST SP 800-63B-4: syncable authenticators","https:\u002F\u002Fpages.nist.gov\u002F800-63-4\u002Fsp800-63b\u002Fsyncable\u002F",{"label":106,"url":107},"NIST SP 800-63B-4: authenticator requirements","https:\u002F\u002Fpages.nist.gov\u002F800-63-4\u002Fsp800-63b\u002Fauthenticators\u002F",{"label":109,"url":110},"CISA: Cross-Sector Cybersecurity Performance Goals (MFA)","https:\u002F\u002Fwww.cisa.gov\u002Fcpgs",{"label":112,"url":113},"Electronic Frontier Foundation: EFF Diceware Passphrases","https:\u002F\u002Fwww.eff.org\u002Fdice",[115,117,119,121,124,127],{"path":13,"label":116},"Account access and two-factor authentication audit",{"path":15,"label":118},"Choosing a business password manager",{"path":14,"label":120},"Google Workspace 2-Step Verification rollout",{"path":122,"label":123},"\u002Fblog\u002Flost-mfa-device","Account recovery after losing a 2FA device",{"path":125,"label":126},"\u002Fblog\u002Fmicrosoft-365-account-compromise","Microsoft 365 account compromise investigation",{"path":128,"label":129},"\u002Fblog\u002Femployee-offboarding-access","Revoking access and sessions during offboarding",{"title":131,"description":132,"button":133,"type":134},"Review account security and resilient 2FA deployment","Assess administrator accounts, recovery pathways and session risks without sharing credentials.","Discuss access security","check",[136,145,151,157],{"id":137,"path":138,"title":139,"description":140,"category":141,"artwork":142,"order":143,"publishedOn":144},"ai-awareness","\u002Fblog\u002Fai-cyber-threats-access-hygiene-employee-awareness","AI Phishing: Verification Habits for Business Teams","AI-assisted phishing uses convincing messages to influence people into disclosing information or taking unsafe actions. Polished writing does not verify the sender. Confirm payment changes, access requests and sensitive disclosures through an existing trusted contact, supported by clear approvals, suitable MFA and a simple route for staff to report concerns.","access","performance",98,"2026-05-07",{"id":146,"path":128,"title":147,"description":148,"category":141,"artwork":141,"order":149,"publishedOn":150},"P052","Employee offboarding access checklist for small businesses","Remove a former employee’s access without losing business data: accounts, sessions, apps, secrets, shared files, ownership and verification. Plan provider-specific actions.",97,"2026-10-24",{"id":152,"path":14,"title":153,"description":154,"category":141,"artwork":141,"order":155,"publishedOn":156},"P063","Google Workspace 2-Step Verification setup without avoidable lockouts","Plan Google Workspace 2SV by users, policy scope, enrollment, recovery and enforcement. Verify actual sign-in behavior before extending the rollout.",88,"2026-10-18",{"id":158,"path":15,"title":159,"description":160,"category":141,"artwork":141,"order":161,"publishedOn":162},"P065","How to choose a business password manager and test the fit","Compare business password managers through ownership, vault access, recovery, staff workflows and exit. Use a synthetic pilot before moving production secrets.",80,"2026-10-10",[],null,{"path":166,"label":167},"\u002Fresources","Website security resources and templates",{"path":169,"label":170},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134059495]