Key points at a glance
- A password on its own offers poor protection: it can be phished, guessed or stolen from another service.
- The Federal Office for Cybersecurity NCSC (BACS) recommends turning on two-factor authentication wherever possible - especially for your email account.
- Passkeys are tied to the genuine website and can't be used on a fake page. That makes them the most secure way to log in for everyday use.
- Plan for emergencies: set up a second passkey or backup codes before you lose your phone.
Why a password alone isn't enough
Most attacks on small businesses aren't sophisticated hacks - they use stolen credentials. Three methods are particularly common:
- Phishing: A convincing fake email leads to a fake login page. If you type your password there, you hand it straight to the attackers.
- Password reuse: When an online shop is hacked, attackers automatically try the stolen email and password combinations on other services. If you use the same password everywhere, you lose several accounts at once.
- Weak passwords: Short or obvious passwords can be cracked by software in no time.
That's why the NCSC advises using a separate password of at least 12 characters for each service - plus a second factor.
The second factor: app instead of SMS
With two-factor authentication (2FA), you need something only you have in addition to your password - usually your phone. Even if someone knows your password, they can't get in without this second factor. There are several options:
| Method | How it works | Assessment |
|---|---|---|
| SMS code | Code sent to your phone by SMS | Better than nothing, but the weakest option: text messages can be redirected, and the code can be intercepted on a phishing page. |
| Authenticator app | The app shows a new six-digit code every 30 seconds (e.g. Microsoft Authenticator, Google Authenticator) | Good and widely used. But this code can also be typed into a fake page and misused. |
| Passkey | Log in with your fingerprint, face or device PIN | Most secure: tied to the genuine website, nothing to type in or intercept. |
Passkeys: more secure and easier at the same time
A passkey replaces the password with a key pair based on the FIDO2 or WebAuthn standard. The private key stays on your device or in your password manager; the website only knows the public key. You confirm the login the way you unlock your device: with Windows Hello, Face ID or Touch ID, with your phone's PIN - or with a security key plugged into a USB port.
The big advantage: a passkey is tied to the address of the genuine website. On a fake page, it simply doesn't work, and there's no secret you could accidentally give away. The FIDO Alliance, which develops the standard, explicitly names phishing resistance as a key goal.
Passkeys come in two forms:
- Synced: The passkey is stored in your Apple, Google or Microsoft account or in your password manager and is available on all your devices. Convenient - if you lose a device, you don't lose the passkey.
- Device-bound: The passkey never leaves one specific device, such as a security key. Very secure, but you need a second key as a backup.
Plan for emergencies in advance
The second factor protects you - but it can also lock you out if your phone breaks or goes missing. So plan a backup from the start:
- Where possible, set up two factors - for example a passkey on your laptop and one on your phone, or a passkey plus an authenticator app.
- Many services offer backup or recovery codes. Keep them offline - printed out and stored in a safe place, not as a photo on your phone.
- Take extra care to protect your email account. Through "Forgot password", it's the key to almost all your other accounts.
Example: the phone falls in the water
Sandra runs a graphic design studio with two employees. After a trip to the lake, her phone is ruined. Because she had also set up a passkey with Windows Hello on her laptop for her bookkeeping, email and e-banking, she carries on working as usual the next morning. She then sets up the authenticator app again on her new phone and deletes the old entry.
Practical steps for your team
- Personal accounts: Everyone has their own login. With shared accounts, you can't tell who did what, and it's hard to cleanly revoke access when someone leaves.
- Introduce a password manager: It generates and stores a separate, strong password for each service. Protect the password manager itself with a long master password and a second factor.
- Turn on two-factor authentication everywhere: email, e-banking, bookkeeping and cloud storage first, then everything else.
- Use passkeys where offered: More and more services support them - Microsoft, Google, Apple and many business applications.
- Have a process for departures: When someone leaves, disable their accounts immediately, change the passwords of shared devices and collect company devices.
How it works in Easly
Easly stores invoices, receipts and personnel data. That's why a second factor isn't optional in Easly - it's mandatory:
- Secure first login: After you order, you receive a one-time link by email. You use it to set your password and immediately set up the authenticator app as your second factor; you can then add passkeys under "Settings → Security". Passwords are never sent by email.
- Two factors are mandatory: Without a passkey or authenticator app, you can't get past the setup page. Passwords must be at least 12 characters long.
- Log in with a passkey: With a passkey, you log in without any password at all - via Windows Hello, Face ID, Touch ID or a security key. You can register several passkeys plus an authenticator app.
- No accidental lockout: You cannot remove the last remaining second factor.
- Protection against password guessing: After several failed attempts, Easly temporarily blocks login.
- Lost your phone? Contact us. After verifying your identity, we send a new one-time link to the email address on file so you can set up your second factor again. But the fastest way doesn't involve us at all: a second passkey as a backup.
- Support only with your code: If you need help, you create an access code that is valid for up to 72 hours and can be revoked at any time. Without this code, support can't access your instance.
Frequently asked questions
Is an SMS code secure enough as a second factor?
An SMS code is much better than no second factor at all. But an authenticator app and especially passkeys are more secure, because text messages can be redirected and codes can be intercepted on fake pages.
What happens to my passkey if I lose my phone?
If the passkey is synced via your Apple, Google or Microsoft account or your password manager, it's still available on your other devices. Device-bound passkeys are lost along with the device - that's why you should always have a second factor as a backup.
Can a passkey be stolen?
The private key of a passkey never leaves your device or your password manager, and the website only stores the public key. If a service is hacked, there's no password to steal. But do protect your device and your Apple, Google or Microsoft account carefully, because they unlock your passkeys.
Do I really need a password manager if I run a sole proprietorship (Einzelfirma)?
Yes, especially then. It's the easiest way to have a separate, strong password for each service without having to remember anything. Many password managers also store passkeys.
Information as of: see above. Sources: recommendations of the Federal Office for Cybersecurity NCSC (BACS) on passwords and two-factor authentication and the FIDO Alliance's description of passkeys. This article is not a substitute for individual security advice.