Why multi-factor authentication matters more than a strong password
Stolen passwords are behind most account takeovers. Here is why MFA stops the majority of them, which method to choose, and how to roll it out on campus without a revolt.
Passwords get stolen — through phishing, reused credentials from other breaches, and malware. Once an attacker has a password, a strong password offers no further protection. Multi-factor authentication (MFA) adds a second check that the attacker usually cannot pass: something you have (a phone or hardware key) alongside something you know.
What MFA stops
Credential-stuffing and most phishing attacks fail when the attacker has the password but not the second factor. For institutions this protects the accounts that matter most: email, examination administration, finance, HR, cloud consoles and the admin side of every platform.
Choosing a method
- Authenticator app (time-based codes or push approval): good security, works offline, free. The default choice.
- Hardware security key (FIDO2/WebAuthn): the strongest option, resists phishing entirely; ideal for administrators.
- SMS codes: better than nothing, but SIM-swap and interception attacks exist. Use as a fallback only.
Rolling it out without a revolt
- Start with administrators and staff who handle money or data — the smallest group with the highest risk.
- Communicate the why in one paragraph, show the 2-minute setup, and offer drop-in help for a week.
- Give a recovery path (backup codes, a helpdesk process) so nobody is locked out for good.
- Expand to all staff, then students, with a date announced well in advance.
- Measure: track adoption weekly and follow up with the laggards personally.
Pair MFA with a sensible password policy — long passphrases, no forced rotation — and you have removed the most common way institutions get breached.