My husband recently asked me about multifactor authentication and hardware security keys. He had read about thieves looking over the shoulder of someone using an Apple iPhone, watching while they typed in their six-digit security code, and then stealing their iPhone and (using the code) gaining access to all of the information on their phone. Unfortunately this information also included their Apple ID, which gave the criminal access to all of their Apple devices and even their credit cards and bank accounts.

Most people today understand the concept of a password for their account. The password combined with your username is the first level of authentication. A short password is not only easier to guess and easier to "brute force" (i.e., generate via computer), but easier to remember if you are staring over a person's shoulder. A six-digit "key" is incredibly easy to either remember or brute force because there are fewer Arabic numerals than alphabetic characters and only six places for them to memorize. This is why password checking systems want "eight or more alphanumeric characters with special characters" (as an example), to both make it difficult to remember and to brute force. However these type of passwords are very hard to remember, so people tend to use simpler ones or names of people or pets and these are easier for the thieves to guess.

A better way is to use a "pass phrase." A long string of characters, perhaps even part of a sentence that is easy for the user to remember, intermixed with special characters to make it even better. Consider using a phrase like part of a favorite song – just a few first words – now put a digit between those words such as "mine1eyes3have5seen". The number of words, combined with not knowing what digit or special character is used between the words, makes this passphrase almost impossible to guess unless you hum the song as you type it in, and even then it is "hard."

[...]