multi-factor authentication

A strong password does not stop credential stuffing, because the attacker already has a valid one from another breach. Here is what actually works instead.