If the person who pilfered your password doesn’t have that additional piece of identification, they won’t be able to sign in. That’s the principle behind multi-factor authentication, also known as 2-factor authentication (2FA) or two-step verification. You need to provide one additional piece of identification before I allow you to sign in.”

In that case, the website looks at the attempted login and says, “Hmmm, I don’t recognize this device. The solution is to set up each online account so that a password alone isn’t sufficient to sign in on a device you’ve never used before.

This method is extremely effective against users who use passwords that are almost identical. And note that the engineer who was targeted in that attack should never have been accessing such sensitive resources from a computer running personal software.)Īnd when all else fails, there’s the good ol’ brute force attack, in which a bad guy just keeps trying to sign in using different passwords until he finds one that works.

(That’s the method used by attackers who breached servers containing LastPass user data. If you’re fooled by a phishing email, you might unknowingly turn over your user name and password to an attacker.Ī vulnerability in otherwise innocent software can result in a keylogger (or other forms of malicious software) being installed on your PC. If you’re in the habit of reusing passwords, as too many people are, a breach at an unrelated site can make it possible for an attacker to access any account that uses those credentials. How can that happen? Let us count the ways:Ī data breach at the service provider can expose user names and passwords.

Yubico security key amazon