Multi-Factor Authentication

Multi-factor authentication proves control of two or more distinct factor types, such as a password and a security key. It makes stolen passwords less useful, but its strength depends on the authenticators, enrollment, recovery, and protection against phishing.

itIdentity, access, and cryptography

Don't Panic - Multi-Factor Authentication

Multi-factor authentication is a security property of a login transaction: the service demanded evidence from two or more distinct categories of proof before it let you in. A password plus a code from your phone is MFA. Two passwords are just two passwords, because they are both things you know, and things you know are one factor.

The whole point is that stealing one secret stops being enough. A phished password, a guessed password, a reused password - none of them grant access on their own when a second, independent factor is in the way. That single idea reduces the blast radius of the credential breaches that dominate modern attacks.

Here is the part that surprises most people: the login screen is not where MFA matters most. It is where MFA is easiest to deploy and most visible to users, which is why it gets all the attention. The lifecycle stages that surround it - binding a new authenticator, recovering a lost device, replacing a compromised key, removing an old one - are where the real security decisions live. A help desk that can reset your MFA after a phone call backed only by your date of birth has quietly made your hardware security key a decoration.

The two ideas everything else hangs on are phishing resistance and lifecycle assurance. Phishing resistance means the authentication protocol is cryptographically tied to the real site domain, so a fraudulent page cannot capture a usable result. WebAuthn and FIDO passkeys do this; TOTP codes and push notifications do not. Lifecycle assurance means you apply the same level of scrutiny to account recovery and authenticator enrollment that you apply to the login itself, because an attacker who can complete either one does not need to beat your login at all.

If you remember only one thing a week from now, make it this: the question is not whether you have MFA enabled. The question is which path is easiest for an attacker to take over the account. Find that path. Then make it earn the assurance your risk requires.

Read the Don't Panic tab first to orient yourself. The Slides give you the conceptual map. Field Notes is where practitioners tell you what actually goes wrong. The Reference tab has the standards and guides you will want when you start making choices.

Don't Panic - Multi-Factor Authentication

Relevant careers