Multi-Factor Authentication

A stolen password shouldn't be enough to take over an account. If a password is your only barrier, an attacker who nabs it is in.

Multi-factor authentication (MFA) requires proof from two or more distinct factor types:

• Something you know: A password or PIN
• Something you have: A device containing an authenticator secret, like a phone or security key
• Something you are: A biometric characteristic, like a fingerprint or face

A password plus a PIN... is still weak. Both are "something you know." We need to mix factor types. A physical security key is a good second factor for a password because it's "something you have." A fingerprint or face can activate an authenticator, but a biometric characteristic isn't an authenticator by itself.

Why MFA

Obviously, we don't want passwords to get stolen... but it happens. MFA makes stolen passwords less useful, because an attacker still needs control of a separate authenticator. Common second factors include:

• TOTP codes: Short-lived codes generated from a secret held by an authenticator app
• Out-of-band authentication: A separate device exchanges a short-lived secret with the login flow
• Biometric-activated authenticators: A device checks a fingerprint or face locally before using its stored authenticator secret
• SMS codes: Short-lived codes sent via text message (should be restricted because phone numbers can be hijacked)