Overview
Multi-Factor Authentication (MFA) requires two or more independent proofs of identity from different categories. It is one of the single most effective controls against account takeover, and understanding its forms — and their relative strength — is essential.
Learning objectives
- Define MFA and why "different categories" matters.
- Compare common MFA methods by strength.
- Recognize the limits of weaker MFA methods.
Core concept
MFA combines factors from at least two of the three categories (know / have / are). Requiring two passwords is not MFA — they are the same category. Common second factors, roughly weakest to strongest:
- SMS one-time codes — better than nothing, but vulnerable to SIM-swapping and interception.
- Authenticator apps (TOTP) — time-based codes generated on your device; no network needed, much stronger than SMS.
- Push notifications — approve/deny prompts; convenient but vulnerable to "MFA fatigue" (spamming prompts until a tired user approves).
- Hardware security keys (FIDO2/WebAuthn) — cryptographic keys resistant to phishing; the strongest common option.
How it works
A phishing-resistant key (FIDO2/WebAuthn) proves possession of a private key tied to the specific website's domain, so a fake look-alike site cannot relay the response. Weaker methods (codes, pushes) can be phished or relayed because the human simply reads or approves something an attacker can trick them into sharing.
Practical example
An attacker phishes an employee's password and enters it. With TOTP MFA, they are stopped at the code prompt. If the company instead used a FIDO2 security key, even a convincing phishing page that captured the password would fail, because the key will not authenticate to the wrong domain. This is why high-value accounts increasingly mandate hardware keys.
Cybersecurity relevance
Enabling MFA — especially phishing-resistant MFA — dramatically reduces automated and phishing-based account takeover. It is a recurring recommendation from CISA and NIST for protecting accounts, and a common first hardening step you will apply throughout defensive work.
Common mistakes
- Assuming all MFA is equal. SMS is far weaker than a hardware key.
- Approving push prompts reflexively (MFA fatigue) — approve only prompts you initiated.
- Requiring "two passwords" and calling it MFA — same factor category, not multi-factor.
Key takeaways
- MFA uses two or more proofs from different factor categories.
- Strength ranges from SMS (weak) to authenticator apps to phishing-resistant hardware keys (strongest).
- Phishing-resistant MFA defeats attacks that steal passwords or relay codes.
Check your understanding
- Why is "password + security question" not true multi-factor authentication?
- What makes a FIDO2 hardware key resistant to phishing when a TOTP code is not?