Why one password is not enough
A password is the single secret protecting an account, and it has several standard ways of leaking: brute-forced from a dictionary or a list of previously leaked passwords, phished through a fake email or a convincing copy of a familiar login page, stolen by a keylogger on an infected device, or found in the database of some entirely different service that got breached and dumped publicly — because people reuse the same or similar password in several places at once.
Once an attacker has the password by any of those routes, access is complete and immediate. No amount of password complexity helps after the fact, if the whole thing leaked rather than being guessed piece by piece.
What the second factor does
Two-factor authentication asks for something beyond the password at login — a code from an app on your phone, a confirmation on a separate device, a fingerprint, a hardware key. Even if the password has been stolen by any of the means above, login fails without the second factor: the attacker also has to steal or reach a separate device, which is a completely different level of effort and out of reach for the mass automated scanners and bots.
Worth being clear about: 2FA does not make the password irrelevant and does not lower the bar on complexity. It is an additional, independent barrier that comes into play precisely when the first one has already been breached.
Where to switch it on first
- •Site admin panel and hosting control panel — direct access to content and server configuration,
- •Corporate email — it is used to reset passwords on every other service the company has,
- •Online banking and payment services — direct financial exposure if compromised,
- •Cloud storage and CRM holding customer data — the most sensitive information about the business.
Email deserves priority on that list: with access to it, an attacker can request a password reset on almost any other service, including hosting, the site admin panel and even bank notifications, building a whole chain of compromise from a single entry point. What that chain looks like from the other side is in signs your website has been hacked, and the wider checklist is in the server security audit checklist.
Frequently asked questions
How is 2FA different from just having a strong password?
A strong password is a single factor, and it can be stolen whole: brute-forced, phished, or found in somebody else’s breach dump. A second factor — a separate device or app — has to be stolen separately from the password, which is an order of magnitude harder because it needs physical access or the compromise of another channel.
Is an SMS code reliable 2FA?
Better than nothing, but not the strongest option available. SMS can be intercepted through SIM swapping — an insider at the carrier, or social engineering — or through weaknesses in mobile network protocols. An authenticator app is stronger because the code is generated locally on the device and never travels through the carrier.
Where should a company start with 2FA?
With the most critical accounts: the site admin panel, corporate email, hosting and server control panel, online banking. These are the points where compromising one account gives an attacker cascading access to everything else — through email alone you can reset passwords on a dozen other services.