AhaBulbStuff Everyone Should Know
AhaBulb: Stuff Everyone Should Know · ahabulb.com/passwords-mfa

Is a password enough?

Not even close. Add a second factor. Any one beats a password alone.

Start playing free

The Just Right card

Too littleOne password, used everywhere
Too muchLocked down tight with no backup codes
Just rightPassword manager, MFA everywhere, passkeys where you can

Huh, didn't know that: Text code: good. Authenticator app: better. Passkey: best.

The dad joke
Somebody tried to SIM swap my number. Joke's on them. All they got were calls about my car's extended warranty.
Like this card?
Play the game
AhaBulb card: Is a password enough?

Download the printable card

References

Answer: No, add a second factor, like a passkey. Any second factor stops most account hacks. A text code is good, an authenticator app is better and a passkey is best.

  1. NIST authenticator examples pages.nist.gov/800-63-4-Implementation-Resources/authenticator/index.html
    FIDO2 passkeys with user verification
    Checked 2026-10-09.
  2. NIST Digital Identity Guidelines pages.nist.gov/800-63-4/sp800-63b.html
    Email SHALL NOT be used for out-of-band authentication
    Checked 2026-10-09.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacySomeone contacts you asking for the two-factor code just sent to you. Per the FBI, who can you give it to?Security & PrivacyYou entered your password on a phishing page. What does Microsoft say to do immediately?Security & PrivacyWhich kind of MFA does CISA call the gold standard?

That's stuff everyone should know.