Fundamentals Multi-Factor Authentication

Multi-Factor Authentication, or MFA, asks a user to prove identity in more than one way before granting access. A stolen password alone no longer opens the door. Security experts rank MFA among the most effective steps an ordinary person can take.

The Bank Vault Example

A bank vault may need a key and a secret code. Stealing only the key gets a thief nowhere. Learning only the code fails too. Online accounts follow the same idea. Each extra proof forces an attacker to defeat another barrier.

The Three Types of Factors

Two passwords do not count as MFA, since both belong to the same factor type. A password plus a phone code counts, since the factors differ.

The Login Flow

 [Enter username and password]
              |
              v
      Password correct?
        |            |
       No           Yes
        |            |
     Denied          v
              [Second proof requested]
              (app code, key, fingerprint)
                     |
                     v
              Second proof correct?
                |            |
               No           Yes
                |            |
             Denied       Access granted

Common MFA Methods

Text Message Codes

A service sends a short code by SMS. The method is easy to use, though criminals can sometimes hijack a phone number.

Authenticator Apps

An app on the phone generates a new code every 30 seconds. The codes work without a mobile signal and resist interception better than SMS.

Push Notifications

The service sends an approval request to a trusted phone. The user taps approve or deny.

Hardware Security Keys

A small USB or NFC device confirms the login when the user touches it. Hardware keys resist phishing very well.

Biometrics

Fingerprint and face scans offer speed and convenience. Devices store the scan data locally and do not send it to websites.

Strength Ranking

1. Hardware security keys give the strongest protection.
2. Authenticator apps provide strong protection for daily use.
3. Push notifications offer convenience with moderate protection.
4. SMS codes beat having no second factor at all.

Attacks Against MFA

Attackers adapt to every defense. Prompt bombing floods a user with approval requests until the user taps approve out of annoyance. Fake login pages ask victims to type the one-time code, and the attacker uses it within seconds. SIM swapping tricks a phone company into moving a number to the attacker's card.

Users counter these tricks with simple habits. Deny every request that the user did not start. Never share a code with anyone, including people who claim to work for a bank. Prefer apps and hardware keys over SMS for important accounts.

Setting Up MFA

1. Open the security settings of the account.
2. Select two-step verification or multi-factor authentication.
3. Choose an authenticator app or hardware key.
4. Scan the displayed code with the app.
5. Save the backup codes in a safe place away from the phone.
6. Test the login in a private browser window.

Start with email, banking, and cloud storage accounts. Attackers who control an email account can reset passwords everywhere else.

MFA for Businesses

Organizations require MFA for email, remote access, and administrator accounts. Policies often relax the rule on trusted devices at the office and tighten it for unknown locations. Staff receive clear instructions and a help desk number for lost phones. Regular reviews remove old devices from user profiles.

Key Points

• MFA combines at least two different types of proof.
• The factors are knowledge, possession, and inherent traits.
• Hardware keys and authenticator apps beat SMS codes.
• Backup codes protect against a lost phone.