The second key

Two items ago you saw passwords leak by the millions, and one item ago you saw the truth that follows from it: attackers don’t break in, they log in. They buy a stolen password and walk through the front door. So here is the question that actually matters. Not “how do I keep my password secret?” — that battle is already half lost the day a company you use gets breached. The real question is: what happens when your password is already out? A second factor is the answer.

The password was always the weak proof

Back in item two, security checked who you are using three kinds of proof: something you know (a password), something you have (a phone, a plug-in key), something you are (a fingerprint, a face). A password is the “know” kind, and the “know” kind has a fatal flaw. It can be copied without you losing it.

If someone steals your bike, you notice — it’s gone. If someone steals your password, you notice nothing. They have a perfect copy and you still have yours. Worse, a password can leak from a company’s database, be guessed, be reused across sites, or be typed straight into a fake page. Every weakness from items three, four, and five lands on the same single proof.

So the fix is not a better password. The fix is a second, different proof — one from a different family that the attacker doesn’t get just because they got your password.

A second key the thief doesn’t hold

A second factor means the login asks for two proofs from two different families. First the password (know). Then a code on your phone, or a tap on a plug-in key (have). Maybe a fingerprint (are).

The point is the different family. The attacker who bought your leaked password has the “know” half. But your phone is in your pocket, not theirs. The plug-in key is on your keyring. They have one proof and the login wants two. One leak is no longer enough. To get in now, they’d have to leak your password and physically hold your phone — two very different thefts at the same time.

This is why people call it the single best habit an ordinary person can build. It costs you a few seconds; it costs the attacker the one thing they can’t buy in bulk.

A worked example: 1,000 accounts, every password leaked

Picture 1,000 accounts. Every single password has leaked — assume the worst, because over enough years it’s true.

Without a second factor: the attacker takes the list of leaked passwords and tries them. The password is the only gate. So the attacker walks into essentially all 1,000. The leak was the break-in.

Now turn on a second factor. The attacker still has all 1,000 passwords. But each login now wants a second proof they don’t have. So they’re stopped at the second gate on the overwhelming majority — over 99%. About 996 of the 1,000 are blocked cold. The password was right; the second proof was missing; the door stayed shut.

That is the whole lesson in one number. The same leak that owned everything now owns almost nothing.

Why the last few still fall

Be honest about the four that slip through. They weren’t out-computed. They were tricked in real time.

The con from item five comes back, but live. The attacker logs in with the stolen password, which triggers a code or an approval prompt on the real owner’s phone. At that exact moment a fake message or call reaches the owner: “We’re confirming your login — read me the code” or “Tap approve to keep your account safe.” The owner, fooled, hands over the live code or taps yes. The second factor did its job — it asked. The human handed the key over anyway.

So a second factor is not magic. A one-time code can be phished in the moment. This is the honest limit, and it sets up item thirteen.

A code is good; a key is better

There’s a kind of second factor that closes even that gap. A physical security key (or a passkey) is tied to the real site’s identity — the same certificate idea from item nine, where your browser checks it’s really talking to the genuine site. The key will only prove you to the real address it was set up with. Show it a look-alike page and it simply refuses; there’s no code to read out, nothing to relay.

So rank them plainly. Any second factor beats none by a mile — the jump from ~1,000 owned to ~4 owned is enormous. A texted code can still be phished live. A phishing-resistant key blocks even that. If you do one thing after this course, turn on a second factor for the account that resets everything else: your email.

On the whole

Notice what just happened to the question. We stopped trying to keep the password perfectly secret — an impossible promise — and instead built the next layer for when it fails. That is what security actually is: not one perfect wall, but layers, each one assuming the one before it will eventually give way.

You are inside this, not above it. Every important account you hold is one password away from a stranger who may already have it. Turning on a second factor is you, with your own hands, adding a second gate to your own door — and quietly stepping out of the 1,000 who fall and into the 996 who don’t.