Multi-Factor Authentication (MFA)
A security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity.
Detailed Explanation
MFA typically requires a combination of something you know (password), something you have (a phone/token), or something you are (fingerprint). Even if an attacker steals your password, they cannot access your account without the second factor. Implementing MFA is the single most effective way to prevent account takeovers.
Quick Summary
MFA requires two or more independent proofs of identity before granting access. It is the single highest-ROI security control for any account system, credential theft alone stops being enough.
Key Takeaways
- Factor categories: knowledge (password), possession (phone, hardware key), inherence (biometric).
- Phishing-resistant factors (WebAuthn / passkeys, FIDO2 hardware keys) beat TOTP, which beats SMS.
- SMS-based MFA is better than nothing but vulnerable to SIM-swap attacks; deprecate it for admin accounts.
- TOTP (authenticator apps like Google Authenticator) is the practical default, cheap, no SMS dependency, broadly supported.
- Provide secure recovery: backup codes, recovery email, or a second registered device. Account-lockout horror stories are usually recovery failures.
When to use it
- Protecting admin and developer accounts where breach impact is highest.
- Compliance requirements (SOC2, HIPAA, PCI-DSS) for production access.
- Step-up authentication: require MFA for sensitive actions (changing email, exporting data, wiring money) even within an active session.
- Replacing passwords entirely with passkeys for passwordless flows.
Common Mistakes
- Making MFA optional indefinitely, most users never enable it. Enforce it, at least for sensitive roles.
- Allowing fallback to SMS or email codes that bypass the strong factor.
- No backup factor; one lost phone becomes a permanent lockout and a flood of support tickets.
- Treating "MFA at login" as enough; long-lived sessions silently bypass it for days or weeks.
Multi-Factor Authentication (MFA), Frequently Asked
Are passkeys MFA?
Passkeys are inherently multi-factor in one step: possession (the device storing the key) plus inherence or knowledge (biometric/PIN to unlock it). They replace password + TOTP with a single phishing-resistant credential.
Should I require MFA for all users or just admins?
Require it for admins and anyone with elevated privileges, non-negotiable. For end users, strongly encourage it, and require it before sensitive actions. Modern consumer apps default it on for new signups.