Myth-Busting SOP: 'A 20-Char Password Makes 2FA Unnecessary'

Myth-Busting SOP: 'A 20-Char Password Makes 2FA Unnecessary'

Length stops brute force. It does nothing against phishing, reuse breaches, or infostealer malware that grabs the saved credential. Layer up:

— Step 1: Keep the long passphrase, but treat it as one factor only.
— Step 2: Enforce TOTP 2FA for all privileged roles; passwords leak, second factors don't ride along.
— Step 3: Block password reuse by checking new passwords against the Have I Been Pwned k-anonymity API.
— Step 4: Set sessions to expire and require re-auth for role/permission changes.
— Step 5: Verify by pasting a known-breached password into the change form — it must be rejected.

Strength resists guessing, not theft. Run this every time.