Passwords and MFA without the pain

Why this lesson is about laziness

Security advice usually fails not because people don’t understand it, but because it’s too much work. So you won’t find “invent a 16-character password for every website” here. You’ll find three things that, once done, let you stay lazy with a clear conscience.

The bad news about your password

If your password is a word, a name, a date of birth or a year with an exclamation mark, a program guesses it in seconds. Not because it’s clever, but because it has a list of every popular pattern. “Summer2026!” is on that list — and so is its Lithuanian twin, “Vasara2026!”.

And nobody even has to target you personally. The program tries the same popular password on thousands of accounts in a row — this is called password spraying. It only takes one person in the company using “Summer2026!” to open the door to the whole company’s email.

A passphrase instead of a password

Four unrelated words are both longer and easier to remember: green-horse-eats-concrete. It’s a long password, but to you it’s a picture in your head. It’s the only password you’ll need to remember at all (see the next step).

A password manager does the rest

One strong password unlocks the manager, and the manager invents and remembers all the others — a different one for every website. You no longer have to think them up, remember them or write them on a sticky note.

There are several free and reliable options; if your company uses M365, the browser’s password manager with your work account is often enough. What matters most is that passwords aren’t reused.

Why reusing a password is the most dangerous habit

When a website’s data leaks, scammers immediately try the same email and password on banks, Facebook and work email. This is called credential stuffing, and it’s a fully automated process.

One reused password turns one leak into ten problems.

MFA — the most important step in this lesson

MFA (multi-factor authentication) means a password alone isn’t enough: you also need a code from your phone. Even if a scammer has your password, they’re stuck.

If you do just one thing from this whole lesson — switch on MFA for your work email.

Not all MFA is equal

• Passkey — logging in by unlocking your phone or computer (fingerprint, face, PIN). As resistant as a hardware key, but nothing to carry around.
• Hardware key — the safest, but you need to have it with you.
• An app on your phone (Microsoft/Google Authenticator) — a good balance.
• SMS code — the weakest option, because a number can be hijacked, but still incomparably better than nothing.

What each one stops — in one table:

What each MFA method stops

Method	Stolen password	SIM swap	Fake page (AiTM)	Notification bombing
SMS code	✓	✗	✗	✓
App code	✓	✓	✗	✓
Approve in the app	✓	✓	✗	✗
Passkey / hardware key	✓	✓	✓	✓

MFA fatigue — a new scammers’ trick

Sigitas the scammer (our recurring villain — Sigitas is a common Lithuanian first name) has your password but not your phone. So he keeps pressing “log in” until ten approval requests arrive on your phone — often at night. The maths is simple: someone, somewhere, will tap “yes” just to make it stop.

The rule: an approval request you weren’t expecting always means “no” — and then you change your password.

Switch on MFA in half an hour — AI leads, you tap

Here the AI won’t do the work for you — and that’s how it should be. It can’t scan a QR code with your phone, and it must never see your passwords or codes. But everything else — where to start, what to switch on, which menu item on your phone — is its job. You just tap.

Copy this, fill in the square brackets and paste it into an AI:

You are my security assistant. Help me protect my most important accounts in
half an hour: switch on MFA or a passkey where it's needed most.

ABOUT ME
- Phone: [iPhone / Android]
- Work email: [Microsoft 365 / Google Workspace / other]
- Most important accounts: [e.g. work email, bank, Google, Facebook,
  accounting software]
- Password manager: [which one I use / none]

PROCESS
1. ASK. Ask me the missing questions, one at a time.
2. PLAN. Rank my accounts by importance: money and email first.
   Next to each, say what's best to switch on: a passkey, an app, or at least SMS.
3. DO IT TOGETHER. Guide me through one account at a time: short steps for my
   phone. Wait until I write "done", then move on to the next account.

GOAL
The job is finished when every account on the list has MFA or a passkey switched
on, and the backup codes are saved somewhere safe.

STRICT RULES
- Never ask for my passwords, MFA codes or backup codes. If I write one by
  accident, warn me and tell me to change it straight away.
- Don't invent passwords for me — the password manager does that.
- If you don't know the exact menu name on my phone, say you don't know and
  explain what to look for.
- Answer in English.

AT THE END
A list: where MFA is on, where it isn't, and separately — WHAT YOU DID NOT CHECK.

What never to tell an AI

AI chats are stored — both in your account and on the provider’s servers. So these things never go into a chat, not even “just to check”:

• Passwords and passphrases. Not even to find out whether they’re strong enough.
• MFA codes and backup (recovery) codes. They are the keys to your accounts.
• A password manager export. One file with all your passwords.
• “Invent a password for me.” It stays in the chat history. Passwords come from the manager.

And one more boundary: an AI agent controlling your browser must never type a password for you. It has to ask you to log in.

Pasted a password or code by accident? Don’t panic — change it now, not “later”. Then delete that chat.

For managers: MFA for everyone in a week

One person’s MFA protects one mailbox. A scammer only needs one unprotected one — so MFA has to be on for everyone. AI will prepare the plan and the email to staff.

One warning before you switch it on: security defaults turn off the old sign-in method that printers, scanners and old software often use to send email. First check what in your office sends email on its own — otherwise one morning “scan to email will stop working”.

What to do today

1. Copy the prompt from the section “Switch on MFA in half an hour” and switch on MFA for your work email — AI guides, you tap. No permissions? Ask IT or us.
2. Come up with one passphrase for your password manager — yourself, not with AI.
3. Change reused passwords, at least wherever there’s money or email.
4. Questions? pagalba@itbroliai.lt.

Check yourself

Five questions on what you’ve just read. At the end you’ll get a certificate with your score.