Multi-Factor Authentication
Multi-factor authentication proves control of two or more distinct factor types, such as a password and a security key. It makes stolen passwords less useful, but its strength depends on the authenticators, enrollment, recovery, and protection against phishing.
itIdentity, access, and cryptography | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Multi-Factor Authentication
Multi-factor authentication, or MFA, asks for evidence from more than one distinct factor type before a service grants access. The usual factor types are knowledge, possession, and inherence.
A password is knowledge. A phone, hardware token, or security key is possession. A biometric comparison is inherence. Two passwords are two steps, but they are still only knowledge. They do not make MFA.
MFA reduces the harm from a stolen password. It does not make an account impossible to take over. An attacker can still trick a user into relaying a code, flood a phone with approval prompts, steal a session, or abuse a weak recovery process.
Think in authentication paths
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://pages.nist.gov/800-63-4/sp800-63b.html
Supports
- Authentication factors, authenticator types, and authentication assurance levels
- MFA through a multi-factor authenticator or two distinct factors
- Password, OTP, out-of-band, and cryptographic authenticator behavior
- Authenticator binding, replacement, recovery, and session management
- Phishing resistance, replay resistance, authentication intent, and WebAuthn verifier name binding
- Out-of-band authentication limits, push approval transaction binding, rate limiting, and PSTN risk indicators
- https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html
Supports
- MFA selection, deployment, recovery, bypass, usability, and operational considerations
- https://www.w3.org/TR/webauthn-3/
Supports
- WebAuthn public-key credentials, relying parties, authenticators, registration, authentication, and origin-related behavior
- https://fidoalliance.org/passkeys/
Supports
- Passkeys as FIDO public-key credentials, password replacement, phishing resistance, and device-bound or synchronized options
- https://www.cisa.gov/resources-tools/resources/implementing-phishing-resistant-mfa
Supports
- Organizational implementation guidance for phishing-resistant MFA