Mfa

A clear, defensive explainer of hardware tokens: what they are, the difference between OTP tokens, FIDO2/U2F security keys and smart cards, why security keys are phishing-resistant and OTP tokens are not, and the pros and cons of hardware tokens versus authenticator apps.

A calm, practical guide to a leaked password: how passwords actually leak (breaches, credential stuffing, infostealers and reused passwords), how to check whether yours is exposed, the immediate steps to take, and why unique passwords, a password manager, MFA and passkeys are the durable fix — plus what organisations should do to monitor breached credentials.

A plain-English explainer on man-in-the-middle attacks: what they are, how they work (ARP spoofing, rogue Wi-Fi, DNS spoofing, SSL stripping, adversary-in-the-middle phishing kits), the main attack classes, and the defenses that actually stop them — TLS and HSTS, certificate validation, VPNs on untrusted networks, phishing-resistant MFA, mutual TLS and DNSSEC.

A practical guide to using Google Authenticator and Microsoft Authenticator safely: TOTP vs push, number matching, resisting push-bombing, cloud backup risks, device binding, recovery, and where passkeys beat OTP. With personal and enterprise checklists.

The IT service desk is now a primary attack surface. Learn the Scattered Spider playbook and the concrete identity-verification, monitoring, and Conditional Access controls that stop attackers from calling in to reset passwords and MFA.