# Passwords and MFA without the pain > How to stop keeping passwords in your head or on a sticky note, why MFA stops even a stolen password — and how to switch it all on in half an hour with AI guiding you step by step. ## Why this lesson is about laziness Security advice usually fails not because people don't understand it, but because it's too much work. So you won't find “invent a 16-character password for every website” here. You'll find three things that, once done, let you stay lazy with a clear conscience. ## The bad news about your password If your password is a word, a name, a date of birth or a year with an exclamation mark, a program guesses it in seconds. Not because it's clever, but because it has a list of every popular pattern. “Summer2026!” is on that list — and so is its Lithuanian twin, “Vasara2026!”. And nobody even has to target you personally. The program tries **the same popular password on thousands of accounts** in a row — this is called *password spraying*. It only takes one person in the company using “Summer2026!” to open the door to the whole company's email. ## A passphrase instead of a password Four unrelated words are both longer and easier to remember: `green-horse-eats-concrete`. It's a long password, but to you it's a picture in your head. It's the only password you'll need to remember at all (see the next step). ## A password manager does the rest One strong password unlocks the manager, and the manager invents and remembers all the others — a different one for every website. You no longer have to think them up, remember them or write them on a sticky note. There are several free and reliable options; if your company uses M365, the browser's password manager with your work account is often enough. What matters most is that passwords aren't reused. ## Why reusing a password is the most dangerous habit When a website's data leaks, scammers immediately try the same email and password on banks, Facebook and work email. This is called credential stuffing, and it's a fully automated process. One reused password turns one leak into ten problems. ## MFA — the most important step in this lesson MFA (multi-factor authentication) means a password alone isn't enough: you also need a code from your phone. Even if a scammer has your password, they're stuck. If you do just one thing from this whole lesson — switch on MFA for your work email. ## Not all MFA is equal - **Passkey** — logging in by unlocking your phone or computer (fingerprint, face, PIN). As resistant as a hardware key, but nothing to carry around. - **Hardware key** — the safest, but you need to have it with you. - **An app on your phone** (Microsoft/Google Authenticator) — a good balance. - **SMS code** — the weakest option, because a number can be hijacked, but still incomparably better than nothing. What each one stops — in one table: > **Schema.** Comparing MFA methods: all methods stop a stolen password. An SMS code doesn't stop a SIM swap. An SMS code, an app code and approving in an app don't stop a fake page (AiTM), because the code or approval can be relayed in real time. Approving in an app without number matching is vulnerable to notification bombing. A passkey or hardware key stops all four attacks. ## MFA fatigue — a new scammers' trick Sigitas the scammer (our recurring villain — Sigitas is a common Lithuanian first name) has your password but not your phone. So he keeps pressing “log in” until ten approval requests arrive on your phone — often at night. The maths is simple: someone, somewhere, will tap “yes” just to make it stop. The rule: **an approval request you weren't expecting always means “no”** — and then you change your password. ## Switch on MFA in half an hour — AI leads, you tap Here the AI won't do the work for you — and that's how it should be. It can't scan a QR code with your phone, and it must never see your passwords or codes. But everything else — where to start, what to switch on, which menu item on your phone — is its job. You just tap. Copy this, fill in the square brackets and paste it into an AI: ```text You are my security assistant. Help me protect my most important accounts in half an hour: switch on MFA or a passkey where it's needed most. ABOUT ME - Phone: [iPhone / Android] - Work email: [Microsoft 365 / Google Workspace / other] - Most important accounts: [e.g. work email, bank, Google, Facebook, accounting software] - Password manager: [which one I use / none] PROCESS 1. ASK. Ask me the missing questions, one at a time. 2. PLAN. Rank my accounts by importance: money and email first. Next to each, say what's best to switch on: a passkey, an app, or at least SMS. 3. DO IT TOGETHER. Guide me through one account at a time: short steps for my phone. Wait until I write "done", then move on to the next account. GOAL The job is finished when every account on the list has MFA or a passkey switched on, and the backup codes are saved somewhere safe. STRICT RULES - Never ask for my passwords, MFA codes or backup codes. If I write one by accident, warn me and tell me to change it straight away. - Don't invent passwords for me — the password manager does that. - If you don't know the exact menu name on my phone, say you don't know and explain what to look for. - Answer in English. AT THE END A list: where MFA is on, where it isn't, and separately — WHAT YOU DID NOT CHECK. ```

🤖 AI route recommended

AI sets the order, you tap

With the prompt above, the AI first asks what you use, then ranks your accounts and guides you through each one separately — with menu names for your phone.

“Start with my work email. When we've finished it, tell me which account is next and why.”

Your job: scan the QR code, confirm with your fingerprint or face, and write “done”. Codes and passwords never appear in the chat.

✋ Manual route

Work email without AI

  1. Microsoft 365: open mysignins.microsoft.com/security-info → Add sign-in method → Microsoft Authenticator.
  2. On your phone, install Microsoft Authenticator → + → work account → scan the QR code from your computer screen.
  3. Google: myaccount.google.com/security → 2-Step Verification, and where offered — Passkeys.
## What never to tell an AI AI chats are stored — both in your account and on the provider's servers. So these things never go into a chat, not even “just to check”: - **Passwords and passphrases.** Not even to find out whether they're strong enough. - **MFA codes and backup (recovery) codes.** They are the keys to your accounts. - **A password manager export.** One file with all your passwords. - **“Invent a password for me.”** It stays in the chat history. Passwords come from the manager. And one more boundary: **an AI agent controlling your browser must never type a password for you.** It has to ask you to log in. > Pasted a password or code by accident? Don't panic — **change it now**, > not “later”. Then delete that chat. ## For managers: MFA for everyone in a week One person's MFA protects one mailbox. A scammer only needs one unprotected one — so MFA has to be on for **everyone**. AI will prepare the plan and the email to staff.

🤖 AI route recommended

A plan and an email to the team

“I run a company of [12] people and we use [Microsoft 365]. I want MFA switched on for everyone within a week. Write a one-week plan and a short email to staff: why we're doing it, by when, who will help, and what to do if you lose your phone. First ask me what's missing, one question at a time. Then show me a draft.”

Your job: check the dates and contacts in the email and send it yourself. The “what if I lose my phone” question matters most — without an answer to it, people will be afraid of MFA.

✋ Manual route

For the admin: one switch

  1. entra.microsoft.com → Entra ID (Identity) → Overview → Properties.
  2. Manage security defaults → Enabled → Save.
  3. Staff will be asked to register for MFA when they sign in. It's free.

If the company already uses Conditional Access rules, this isn't the right route — talk to IT.

One warning before you switch it on: security defaults turn off the **old sign-in method** that printers, scanners and old software often use to send email. First check what in your office sends email on its own — otherwise one morning “scan to email will stop working”. ## What to do today 1. Copy the prompt from the section “Switch on MFA in half an hour” and switch on MFA for your work email — AI guides, you tap. No permissions? Ask IT or us. 2. Come up with one passphrase for your password manager — yourself, not with AI. 3. Change reused passwords, at least wherever there's money or email. 4. Questions? **pagalba@itbroliai.lt**. ## Check yourself Five questions on what you've just read. At the end you'll get a certificate with your score.