Module 3 of StartCloud's Cyber Hygiene for Staff learning pathway, in six short units with a knowledge check: how passwords leak from breached websites and get reused against you, why passphrases beat complex passwords, how a password manager makes unique passwords realistic, what MFA is and why authenticator apps beat SMS, and the MFA fatigue and fake verification tricks scammers use.
Password and MFA Habits That Actually Hold Up
How passwords actually get stolen
Let us clear something up first. Nobody is guessing your dog's name, your footy team, or your birthday. Real password theft is boring, industrial, and it almost never starts with you.
It starts with someone else's website getting breached. Passwords leak in bulk, millions at a time, and then criminals run a trick called credential stuffing: take every leaked email-password combo and try it on every other site that matters. It works for one reason only. People reuse passwords.
That pizza shop loyalty site, the forum from 2018, the online store you ordered from once. Their whole customer database, emails and passwords included, ends up for sale.
Criminals bundle millions of leaked email-password pairs into lists and trade them. Yours is probably in a few already. That is not an insult, it is just the internet.
Automated tools fire your old pizza-shop password at banks, email providers and Microsoft 365 sign-in pages, thousands of accounts a minute. If you reused it at work, they are in.
That is the whole scam. One reused password quietly connects a forgotten loyalty account to your work email, and the attacker never had to be clever. The fix, as we are about to see, is not remembering harder. It is making reuse impossible.
Visit haveibeenpwned.com and type in your email address. It is a free, widely trusted service that tells you which known breaches your address has appeared in. Most people find a few. If a password you still use anywhere shows up, change it today, starting with anything work related.
For years we were all told a good password looks like a cat walked across the keyboard: a capital here, a symbol there, a number on the end. The truth is that length beats complexity, and it is not close. Cracking software chews through short passwords no matter how many symbols you sprinkle on, because it already knows every substitution trick. It has seen @ pretending to be an a before. It is not fooled.
The Australian Cyber Security Centre's actual guidance is to use a passphrase: four or more random, unrelated words. Easier for you to remember, dramatically harder for a computer to guess. Every extra word multiplies the work enormously.
P@ssw0rd!On every cracking list ever written. Gone in seconds.
Rex2019!Pet plus year plus exclamation mark. Attackers know this recipe better than you do.
Summer2026!Season-and-year passwords get guessed in bulk, every season, like clockwork.
paddle wombat lantern quartzFour unrelated words. Easy to remember, brutal to crack.
gravel biscuit harbour mothNonsense as a sentence, which is exactly the point.
cactus ferry mustard planetLong enough that guessing it stops being worth anyone's time.
A rough sense of scale, without pretending to be precise: a short password with the usual symbol swaps can fall to modern cracking hardware in hours or days. Four genuinely random words push that into timeframes nobody bothers with. The exact numbers shift as hardware improves, but the gap between the two columns above stays enormous.
The words must be random and unrelated, so no song lyrics, no famous quotes, no "correct horse battery staple" now that the whole internet knows that one. And a passphrase only helps if it is unique to that account. A brilliant passphrase reused everywhere is still one breach away from being a combo-list entry, which brings us neatly to the next unit.
Here is the maths problem. You have somewhere between 80 and 200 accounts. Every one needs a unique password. No human brain does that, which is why humans reuse passwords, which is why credential stuffing works. The only realistic fix is to stop remembering passwords at all.
A password manager holds them for you, behind one strong master passphrase, the only one you ever memorise again. It generates a long random password for each new account, fills it in when you sign in, and warns you when one turns up in a breach. Reuse becomes impossible because you never type, choose, or even see most of your passwords.
How life looks with a password manager
You unlock the manager once with your master passphrase. From then on it does the tedious part: new accounts get a random 20-character password you never have to know, and signing in is a click.
- One strong master passphrase is the only thing you memorise
- Every account gets its own long, random, never-reused password
- It fills passwords in for you, on the right website only
- It nags you when a saved password shows up in a known breach
Fair question, and it deserves a straight answer. Reputable managers encrypt your vault on your device, so even if their servers are stolen, the thieves get a locked box they cannot open without your master passphrase. Nothing is ever zero risk, but the honest comparison is not "manager versus perfect memory". It is "manager versus reusing the same three passwords everywhere", and the manager wins that contest by a mile. If your workplace provides one, use it. That is the version StartCloud sets up for clients, with the business keeping oversight.
Multi-factor authentication, MFA for short, just means proving who you are with two different things: something you know (your password) plus something you have (usually your phone). When you sign in somewhere new, the account asks for a quick approval or code from your phone as well.
Why it matters so much: everything in unit one, the breaches and the combo lists and the bots, assumed a password alone opens the door. With MFA on, a stolen password is nearly useless on its own. The attacker on the other side of the world has your password but not your phone, and the sign-in stops right there. It is the seatbelt of account security. Slightly annoying for two seconds, absolutely worth it on the day something goes wrong.
An authenticator app
An app on your phone, like Microsoft Authenticator, that pops up an approval or shows a rolling six-digit code. Codes never travel over the phone network, so they are much harder to intercept than a text message.
SMS codes
A code texted to your phone. Weaker than an app because text messages can be intercepted or your number hijacked, but still a real barrier. If SMS is the only option an account offers, take it.
Password only
One leaked or guessed password and the account is gone. Given what you learned in unit one about how passwords actually leak, this is not a place to stay.
Setting up MFA takes a few minutes, once, and it is the single biggest safety improvement you can personally make. Honestly, it is worth switching on for your personal email and banking too, because your personal email is the reset button for everything else you own.
MFA is such a good seatbelt that criminals have mostly given up cutting it and started asking politely if you would mind unbuckling. Once your accounts have MFA, the attacks shift from stealing your password to tricking you into approving the sign-in yourself. Two tricks cover most of it.
An attacker with your password triggers sign-in prompt after sign-in prompt, sometimes at 2am, hoping you will eventually approve one just to make your phone shut up. One tired tap and they are in. The prompts themselves are real, which is what makes it sneaky.
Someone rings claiming to be from IT, Microsoft, or your bank. They say they need to "verify your identity" and could you just read out the six-digit code that has appeared on your phone. That code is them trying to log into your account. Reading it out hands them the keys.
Never approve a prompt you did not trigger. If your phone asks to approve a sign-in and you are not actually signing in, tap deny and tell IT, then change that password, because someone clearly has it. And nobody legitimate ever asks for your code. Not IT, not Microsoft, not your bank. The code exists purely to prove the phone is in your hand. Anyone asking you to read it out is, without exception, the attacker.
- Australian Cyber Security Centre (cyber.gov.au): Passphrases
- Australian Cyber Security Centre (cyber.gov.au): Multi-factor authentication
Details were current at the time of writing (July 2026). The ACSC updates its personal security guidance from time to time, so the links above always have the latest.
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. How do most work passwords actually get stolen?
2. Which of these would the ACSC consider the strongest?
3. What is the only realistic way to have a unique password for every account you own?
4. It is 11pm. Your phone lights up with an MFA prompt asking you to approve a sign-in, but you are on the couch watching telly, not signing in to anything. What do you do?
5. Someone calls saying they are from IT and asks you to read out the six-digit code that just appeared on your phone, to "verify your identity". What is going on?