Why Logging In Got So Complicated
Almost nobody believes their own account is worth stealing. The inbox is mostly newsletters, the cloud storage holds a few holiday photos, and criminals surely have bigger targets. That assumption is the reason so many accounts get taken over.
Attackers rarely choose a person at all. They take lists of stolen email and password pairs, run them against popular sign-in pages at scale, and keep whatever opens. An ordinary account is valuable to them for reasons the owner never considered: an inbox can reset other passwords, send invoices that look legitimate, and let someone watch conversations until the right moment to step in.
This is also why signing in stopped being a username and a password. It now involves codes, taps, fingerprints, and the occasional prompt offering to “set up later”. It can feel excessive, but the sensible way to read it is as a record of what attackers have already beaten.
Why there are so many ways to log in
Each method exists because the one before it developed a hole. The progression looks like this:
| Method | What it fixed | How it gets beaten |
|---|---|---|
| Password alone | Stopped casual access | Passwords get reused, guessed or leaked, and one leak opens everything the password was used on. |
| Text message code | Added a second proof | SIM swapping, where a criminal convinces a mobile provider to move your number to their SIM, and message interception. |
| Authenticator app code | No longer tied to a phone number | Typed into a convincing fake login page and relayed to the real one in seconds. |
| Push approval | One tap, no typing | Repeated prompts until someone taps approve out of annoyance, often called MFA fatigue. |
| Passkey or security key | The credential only works on the genuine site | Needs a sensible recovery plan, and some versions depend on the account that syncs them. |
The fake login page in the middle of that table is called an adversary-in-the-middle attack. The page can relay what the victim types to the real site, capture the verification code, and hijack the resulting signed-in session. The victim did everything correctly and still handed over the account.
None of these methods is worthless. MFA generally provides much stronger protection than a password alone, and the gap between having MFA and having none is far wider than the gaps between the methods. The ladder matters at the top end, where attackers are patient and well prepared.
What “set up later” actually leaves open
An account without MFA is not simply unprotected until the owner gets around to it. It is unclaimed. Whoever completes enrolment first decides what the second factor is, and if that person is an attacker holding a stolen password, the owner becomes the one who cannot get in.
Consider a hypothetical. It is a composite, not a client story, but each step reflects how account takeovers genuinely unfold.
A new operations coordinator is given access to a supplier portal on their first week. The portal offers to set up two-step verification now or later. A customer is waiting on the phone, so they tap later. They intend to return to it and never do. Their password is one they have used since a gym membership site that was breached years ago. It sits in a list that criminals have been passing around ever since.
The attackers try that email and password against common business logins, and one works. With no second factor on the account, there is nothing to challenge them. The first thing they do is add their own authenticator app. They read through recent invoices, wait for a payment to a regular supplier, and change the bank details. Nobody notices for days, and the coordinator finds out only when the supplier asks where the money is.
Nothing about this required sophisticated hacking. It needed one postponed prompt and one old password.
Microsoft removed the skip button, and that tells you something
Microsoft used to let users postpone MFA registration for 14 days when security defaults were switched on. Microsoft has since removed that option, so every user registers on their first sign-in. Its reasoning was straightforward: two weeks was long enough for an account to be compromised before protection was in place, and Microsoft says MFA can block more than 99.2% of identity-based attacks.
Skipping can still be possible in some setups, depending on how a tenant is configured, so it is worth checking rather than assuming. The more useful point is what the change reveals. A company with Microsoft’s resources looked at the postponement option, concluded that it was the exploited gap, and took it away.
That raises an uncomfortable question for every other account people use. If the “later” button was too risky to keep on work logins, it is hard to justify pressing it on personal ones. Personal email is the most obvious example, because reset links for nearly every other account land in that inbox, which makes it a master key. Banking, cloud storage and social media accounts follow close behind, and the line between personal and work is thinner than most people admit. Passwords get reused across both, and personal phones often carry work apps. A weakness in one place rarely stays there.
Phishing-resistant MFA and passkeys, minus the jargon
Phishing-resistant MFA is a sign-in method that cannot be handed to the wrong website, even by someone who has been tricked. Passkeys are the version most people will actually meet.
When a passkey is created, the device generates two linked keys. The private one stays on the device. The website keeps the public one. At sign-in, the device proves it holds the private key for the legitimate website, and the person confirms with a fingerprint, face scan or device PIN. A fake page has a different website identity, so the passkey will not authenticate to it. There is no code to type and nothing to relay.
Two limits are worth knowing. A passkey helps prevent credential phishing, but it does not protect a device that already has malware on it, which is why endpoint protection still matters. And passkeys need a recovery plan for lost or replaced phones, because a method that is hard for attackers to bypass can be just as awkward for the owner if nobody has planned for that day.
Where we would start
Moving everyone to passkeys on the same day is rarely realistic, and it is not necessary. The order matters more than the speed.
We would begin with administrators, because an attacker holding admin access can change what everyone else is protected by. Finance staff and anyone who can approve or change a payment come next. Executives follow, since their names carry weight in a fraudulent email. After that, the rest of the organisation.
In our experience, the accounts that slip through are rarely the ones people think about. They tend to be accounts associated with shared mailboxes, staff on extended leave, old service accounts, and new starters who tapped later on day one. Nobody owns them, so nobody notices when they stay unprotected. Getting MFA on every account, using any method, comes before getting the best method on a few.
For organisations using Microsoft 365, Microsoft Entra Conditional Access can enforce sign-in requirements across the business. Policies can require MFA for particular users or circumstances and, with the right configuration and licensing, require phishing-resistant authentication for higher-risk accounts. Security defaults provide a simpler baseline for organisations that do not use Conditional Access.
What the Essential Eight says about it
The Australian Signals Directorate (ASD) is moving in the same direction. Its November 2023 update to the Essential Eight maturity model bolstered the expectation for phishing-resistant MFA at a lower maturity level, bringing it into Maturity Level Two, and added a requirement for workstation sign-in. ASD names smart cards, security keys and Windows Hello for Business as examples. For a wider overview, see our Essential 8 Framework page and guide to the Essential 8.
Where Affinity MSP Fits In
Most businesses we speak to believe they have MFA. Fewer can say which accounts are actually enrolled, which method each one uses, and who is still sitting on a postponed prompt. We start there: an audit of enrolment across the tenant, including accounts associated with shared mailboxes and forgotten sign-ins, then policies that enforce MFA registration and use. Admins and finance staff move to phishing-resistant methods first, with a recovery process agreed before the rollout begins. You can see how exposed your domain is with our free AffinityScan, which checks externally visible exposures rather than internal MFA settings, or explore our managed IT services if you would like help managing MFA and identity protection. You can also contact Affinity MSP to discuss your environment.
FAQ
What is phishing-resistant MFA?
It is a sign-in method that only works on the genuine website, so a fake login page cannot capture or reuse it. Passkeys, security keys and Windows Hello for Business are the common examples.
Is MFA enough on its own?
MFA generally provides much stronger protection than a password alone. Some methods, such as codes and push approvals, can still be defeated by a convincing fake login page, which is why higher-risk accounts are moving to phishing-resistant methods.
What happens if I click “set up later” on MFA?
The account stays protected by a password alone until enrolment is done. Anyone who holds a stolen password can sign in, and in some cases register their own second factor before the real owner does.
Are passkeys safer than a password and an authenticator code?
For phishing, yes. A passkey cannot be typed into a fake page, because it only responds to the real website. It does not protect a device that already has malware on it, so endpoint protection still matters.
How does Affinity MSP help with phishing-resistant MFA?
We audit which accounts are enrolled and with what method, help enforce MFA through appropriate Microsoft Entra policies, move administrators and finance staff to phishing-resistant methods first, and set up account recovery so that nobody is locked out.
