The Hex Files
Passwords and sign-ins
Passwords, multi-factor authentication and the accounts that hold everything together.
No articles match those words. Try one word, such as email or passwords.
Passwords and sign-ins
Passwords, multi-factor authentication and the accounts that hold everything together.
- Explainer
Attackers don't always break in. Sometimes they ask.
Repeated sign-in prompts, and phone calls from someone posing as IT.
1 min readRead - Explainer
People leave. Their accounts often stay.
Accounts and shared passwords that outlive the job are an easy way in.
1 min readRead - Explainer
Why everyone at work needs a password manager
A password manager remembers a different strong password for every account, so nobody has to reuse one.
1 min readRead - Explainer
Length beats complexity: what makes a strong password
A long phrase is stronger and easier to remember than a short password full of symbols, and changing passwords every 90 days is no longer recommended.
1 min readRead - Explainer
Text codes, apps and keys: not all MFA is equal
Any multi-factor authentication is far better than none. Some kinds are much harder for attackers to get around.
1 min readRead - Explainer
How one reused password can open everything
When a website is breached, attackers try the leaked passwords on every other service. Reused passwords make that work.
1 min readRead - Explainer
What dark web monitoring actually does
Dark web monitoring watches for your company's email addresses and passwords in leaked data, so you can act before attackers do.
1 min readRead - Explainer
Why your IT administrator uses two accounts
Administrator accounts can change anything. Keeping them separate from everyday accounts limits the damage a single phishing email can do.
1 min readRead - Explainer
The trouble with shared logins
One login used by several people means no multi-factor authentication, no record of who did what, and passwords that never change.
1 min readRead - What to do if
Locked out of your work account? Here's what to do
Forgotten password, new phone or too many wrong tries: how to get back into a work account safely.
1 min readRead - Explainer
Security keys: the sign-in method phishing cannot fool
A security key is a small device you plug in or tap to sign in. It will not work on a fake website, which makes it one of the strongest protections available.
1 min readRead - Explainer
Should you use “Sign in with” buttons?
Many sites offer to let you sign in with an existing account instead of creating a new password. It has advantages and a few things to watch.
1 min readRead - Explainer
Sign in once: what single sign-on means
Single sign-on lets staff use their work account to sign in to other business apps. Fewer passwords, and one place to turn access off.
1 min readRead - Explainer
SIM swapping: when someone steals your phone number
A scammer convinces your mobile carrier to move your number to their SIM card. Then your calls and text codes go to them.
1 min readRead - Explainer
Why “Summer2025!” is not a strong password
Passwords built from a season, a year and a symbol meet most complexity rules and are among the first things attackers try.
1 min readRead - Explainer
Why the sign-in rules change depending on where you are
Sometimes you sign in without a prompt. Sometimes you are asked for a code, or blocked. That is conditional access at work.
1 min readRead - Explainer
Why we no longer make you change your password every 90 days
Forcing everyone to change passwords on a schedule made passwords weaker. Security guidance now says change them when there is a reason.
1 min readRead - Explainer
Security questions are the weakest part of your account
Your mother's maiden name and first pet are easy to find online. Treat security questions as extra passwords.
1 min readRead - What to do if
Getting a new phone? Move your sign-in app first
If your phone holds your sign-in codes, switching phones without planning can lock you out of work accounts.
1 min readRead - Explainer
Should you let the browser save your passwords?
Browser password saving is better than reusing passwords, but a business password manager does more and keeps work and personal separate.
1 min readRead - Explainer
“Unusual sign-in activity”: real alert or scam?
Warnings about strange sign-ins can be real, or a scam designed to get your password. Check them without using the link.
1 min readRead - Checklist
Keep your account recovery details up to date
The backup email and phone number on an account decide who can get back in. Old ones can lock you out or let someone else in.
1 min readRead - Explainer
How to share a password when you have to
Sometimes a password has to be shared. Email, text and sticky notes are the worst ways. Here are better ones.
1 min readRead - What to do if
My password showed up in a data breach
A notice that your email and password were found in a breach means that combination is now on lists criminals use. Act on it today.
1 min readRead
Have a question we haven't covered?
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.