Most accounts are still protected by a password that people must remember.
This system fails for a predictable reason: memory is limited and accounts are not.
People reuse one password across dozens of services.
When any one of those services is , every account with the same password is .
Rules demanding capital letters and symbols made passwords harder to remember without making them harder to guess.
Two changes have improved matters more than any rule.
Password generate a different long string for every site.
Second , such as a code or a physical key, block an attacker who has the password alone.
Codes sent by text are the weakest of these, because numbers can be moved to another card.
The industry is now moving towards , which store a secret on the device itself.
Nothing reusable is typed, so a fake login page has nothing to steal.
is slow because every service must rebuild its login system.
Until then, a manager and a second factor remove most of the risk.