Intro
Does your password really protect you? Only to a limited extent: stolen and reused passwords are among the most common ways into accounts. This article explains in plain language why conventional passwords are vulnerable, why SMS codes help only to a limited degree and how a hardware key such as the YubiKey protects sign-ins better (source: Rublon on YubiKey and FIDO2 security keys).
“Nobody knows my password” – a misconception
Many people assume: “My password (for example Superman2025) is secret.” In practice, passwords are often reused across several services. If such a combination has been stolen and published somewhere, it is compromised – even if you are unaware of it. Collections of billions of stolen credentials circulate online, and simple passwords such as 123456 or password are still common. Attackers test such data at scale (“credential stuffing”) and gain access to other people’s accounts (source: Cybernews analysis of leaked passwords 2025).
Phishing, manipulation and human error
Even a unique, complex password does not protect against phishing. Fraudsters send convincing emails (“Please sign in here”) and lead users to fake sign-in pages – and the password is gone. Phishing kits and AI tools produce convincing fakes quickly; even IT professionals fall for them. SMS codes and authenticator apps improve security but are not immune: SMS can be redirected through SIM swapping, for example, and codes typed into a phishing page can be intercepted as well. All methods in which a secret is typed or transmitted share the same weakness: the secret can be stolen (source: Yubico on FIDO2).
Comparison: password, password manager, app-based 2FA and YubiKey
Method | Secure? | User-friendly? | Typical vulnerability |
Single password | No | Simple (only one) | Easy to guess or already leaked |
Password manager + your own password | Better | Some effort | Secure your master password well; Phishing possible when typing |
App/SMS 2FA | Good | Additional step | Phishing (code capture); loss of the phone |
Hardware Key (YubiKey) | High (phishing-resistant with FIDO2/WebAuthn) | Set up once, then easy | Physical loss (backup key required) |
Why the YubiKey stands out
A YubiKey works like a real front-door key: an attacker cannot steal it remotely but would have to hold it physically. Passwords, by contrast, are like a key that has been copied and handed out a thousand times – there is always a copy lying around somewhere, for example in a data breach or an old email. With FIDO2/WebAuthn sign-in, the key is bound to the address of the genuine website, so a fake sign-in page does not receive a valid sign-in. You do not type a code that someone could read; you insert the key and touch the sensor. Without this confirmation the key does not respond (source: Yubico on FIDO2).
Common misconceptions and objections
“I don’t need it, I have nothing to hide.” – This is not about secrets but about control. Anyone with access to your email account can trigger “forgot password” on many services and take over further accounts. “An extra key is a nuisance.” – After a short adjustment it becomes routine: the YubiKey sits on your key ring or in your laptop bag, a touch takes a few seconds and typing SMS codes is no longer necessary. “What if I lose the key?” – Set up a backup key from the start; two keys per person are common. Alternatively, keep a second, well-protected sign-in method registered. “I’m not important enough.” – Many attacks run automatically against every reachable account. A hardware key lowers the risk of becoming one of those random victims.
Conclusion: less stress, more security
Passwords alone protect accounts only to a limited extent. Many data breaches stem from weak or stolen passwords and phishing, and the number of stolen credentials runs into the billions (source: Cybernews analysis of leaked passwords 2025). Hardware keys such as the YubiKey make these attacks considerably harder. They are particularly useful for email, cloud storage, administrator access and online banking – wherever a break-in would cause serious damage. Setup effort is modest; what matters is a backup key and a defined recovery path (background: Rublon on YubiKey and FIDO2 security keys).
Business context
Strong authentication is one component of cybersecurity and can be assessed in a structured IT security pre-audit.