4.5 Multi-Factor Authentication

What is Multi-Factor Authentication?

Multi-factor authentication (MFA) requires a user to prove identity using two or more different authentication factors before granting access. This layered approach means that even if one credential (like a password) is stolen, an attacker still can't get in without the other factor(s), greatly reducing the risk of unauthorized access.

The Three Factor Categories

Authentication factors fall into three types: something you know (password, PIN), something you have (smartphone, security token, smart card), and something you are (fingerprint, face scan, other biometrics). True MFA combines factors from *different* categories — two passwords is not MFA, but a password plus a fingerprint is.

Why MFA Strengthens Security

MFA defends against credential theft because a stolen password alone is useless without the second factor. Common implementations include one-time passcodes (OTPs) sent via SMS or app, push notifications, and hardware tokens. While MFA adds a small usability cost, it significantly lowers the success rate of phishing and brute-force attacks.

Key terms

Multi-Factor Authentication (MFA)

Verifying identity using two or more different types of authentication factors.

Something you know

A knowledge-based factor, like a password or PIN.

Something you have

A possession-based factor, like a smartphone, hardware token, or smart card.

Something you are

A biometric factor, like a fingerprint, face scan, or iris scan.

Why MFA improves security

Even if one factor (like a password) is compromised, attackers still need the other factor(s) to gain access.

Try an AP-style question

Which pair is true multi-factor authentication?

1. Two different passwords
2. Password + phone code
3. Password + security question
4. PIN + another PIN