Security Glossary

What it means

A passkey is a phishing-resistant way to sign in. Instead of typing a reusable password, your device creates a unique cryptographic credential for each account and unlocks it with your fingerprint, face, or device PIN.

In practice

You tap “Sign in with a passkey,” your phone asks for Face ID, and you're in — nothing to type, nothing to leak. The secret never leaves your device; the site only ever sees proof that you hold it.

Why it matters

Passkeys can't be guessed, reused across sites, or typed into a fake login page. Modern guidance (including NIST SP 800-63B) treats them as the strongest everyday sign-in method available to most people.

What to do

• Start with your email account — it controls password resets for everything else.
• Keep a device lock on every device that holds a passkey.
• Set up a backup sign-in method (a second device or a security key) before you need it.
• Say yes when an important account offers passkey sign-in; it replaces, not adds to, your password.

What it means

FIDO is a family of open authentication standards — not a brand, app, or product — that defines how phishing-resistant sign-in methods like passkeys and security keys work.

In practice

When a website says “FIDO2 compatible” or “passkey supported,” it's speaking FIDO. The standard ties each credential to the exact website it was created for, so a lookalike site can't trick your device into handing it over.

Why it matters

FIDO credentials are bound to the real website's address. Even a pixel-perfect fake login page can't collect a usable FIDO credential, which is why these methods are called phishing-resistant.

What to do

• Treat “FIDO”, “passkey”, or “security key” sign-in as an account's strongest option when it's offered.
• Keep your browser and phone updated so FIDO sign-in works reliably.
• For high-stakes accounts, a hardware security key is the most portable way to use FIDO.

What it means

TOTP is a temporary login code your authenticator app generates from a shared secret, refreshing about every thirty seconds. You type it in after your password as the second factor of sign-in.

In practice

When you turn on MFA, the site shows a setup key (often as a QR code) that you add to an authenticator app. From then on, the app shows a rolling six-digit code that works only for a short window.

Why it matters

TOTP is far better than a password alone and better than text-message codes, because it doesn't depend on your phone number. But it still has one weakness: it's a code you type, and codes you type can be typed into a fake page too.

What to do

• Use an authenticator app instead of SMS codes where a site offers both.
• Prefer a passkey or security key over TOTP when an account offers one.
• Save the setup key in your password manager so you can move to a new phone.
• Store printed backup codes somewhere safe — they work like passwords.

What it means

MFA means signing in with more than one type of proof: something you know (a passphrase), something you have (a phone, app, or security key), or something you are (a fingerprint or face). One stolen proof isn't enough.

In practice

You enter your passphrase, then approve the sign-in on your phone or tap a security key. An attacker with only your password still can't get in.

Why it matters

Password leaks are routine — MFA is the layer that keeps a leaked password from becoming a broken-in account. All methods beat password-only, but they are not equal: passkeys and security keys resist phishing; typed codes don't.

What to do

• Turn MFA on first for email, banking, and cloud storage.
• Pick the strongest option offered: passkey or security key, then authenticator app, then SMS.
• Save recovery codes when you first switch MFA on.
• Never approve an unexpected login prompt, and never read a login code to anyone who contacts you.

What it means

Phishing is a deceptive message — email, text, chat, or even a phone call — designed to make you click, share information, send money, or hand over account access.

In practice

A message claims to be your bank, a delivery company, or a colleague, creates urgency (“your account will be closed today”), and sends you to a lookalike login page or an attachment. Newer variants use AI to write flawless copy, clone voices, and even abuse sign-in tools like device codes.

Why it matters

Phishing is the front door to most account takeovers. Technology can filter some of it, but the deciding factor is a person pausing before they act.

What to do

• Don't tap links in unexpected messages — open the company's app or type its address yourself.
• Real companies never ask for your password or a login code by message or phone.
• Slow down on urgency and unusual requests; verify through a channel you choose.
• If you already typed your password on a suspicious page, change it immediately from a trusted device.

What it means

Credential stuffing is an automated attack that takes username-and-password pairs leaked from one breach and tries them on hundreds of other websites, counting on people reusing passwords.

In practice

A forum you barely remember gets breached. Criminals feed those credentials into automation that tests them against banks, shops, and email providers — and every account that reused the same password opens.

Why it matters

It's why a breach at an unrelated site can break into your email years later. The attack needs no skill and no personal targeting — only one reused password.

What to do

• Give every account its own unique password — length over complexity (a long passphrase is easiest).
• Use a password manager to generate and remember them.
• Check your email addresses at haveibeenpwned.com to see what's already leaked.
• Turn on MFA so a leaked password alone can't get in.

What it means

Account takeover is when someone other than the owner gains control of an account — usually through a stolen or reused password, a phished login code, or a SIM swap.

In practice

It often starts quietly: password-reset emails you didn't request, new forwarding rules, logins from another country, friends receiving strange messages “from you.” By the time you're locked out, the attacker may have changed recovery details.

Why it matters

A takeover is the end state of most of the attacks on this page. And your email account is the master key — whoever controls it can reset the passwords for almost everything else.

What to do

• From a trusted device, change the password, sign out all sessions, and review connected apps.
• Check recovery email, phone number, and forwarding rules for changes.
• Turn on MFA — ideally a passkey or security key.
• Warn contacts if messages went out in your name, and report it to the service's support or security page.