Multi-Factor Authentication

Multi-Factor Authentication (MFA) requires users to prove identity with two or more independent factors from different categories. Even if one factor is compromised (e.g., stolen password), the account remains protected.

Authentication factors:

• Something you know — password, PIN, security question
• Something you have — phone, hardware token, smart card
• Something you are — fingerprint, face, voice (biometrics)

True MFA uses at least two different categories — not two passwords.

TOTP generates a 6-digit code that changes every 30 seconds using a shared secret and the current time (RFC 6238). Apps: Google Authenticator, Authy, Microsoft Authenticator.

TOTP is secure against replay attacks but vulnerable to real-time phishing.

SMS-based OTP is convenient but has significant weaknesses:

• SIM swapping — attacker social-engineers carrier to transfer victim's number
• SS7 attacks — nation-state interception of SMS at the telecom level
• Real-time phishing — attacker relays OTP instantly from victim to target site

SMS OTP is better than no MFA but is the weakest form.

Hardware security keys (YubiKey, Google Titan) use public-key cryptography. The device signs a challenge tied to the specific website, making them phishing-resistant — they won't work on fake sites.

This is the gold standard of MFA.

Authenticator app sends a push notification: "Approve login from New York?" User taps approve or deny. Convenient but vulnerable to MFA fatigue attacks — attackers spam approval requests until a tired user accidentally approves.

Also called push bombing: attacker has the password and sends dozens of MFA push notifications hoping the user approves one out of frustration or confusion. Countermeasure: require number matching in the push notification (user must enter a code shown on login screen).

Passkeys (FIDO2/WebAuthn) combine "something you have" (device key) with "something you are" (biometric unlock) into a single phishing-resistant credential. No password needed. Supported by major platforms.

Modern identity platforms support conditional access: require MFA only when risk signals indicate it (unfamiliar location, new device, sensitive resource). Step-up authentication improves UX while maintaining security.

Attackers bypass MFA with:

• Real-time phishing (AiTM) — proxy captures session cookie after MFA
• SIM swapping — intercept SMS codes
• MFA fatigue — spam push notifications
• Social engineering helpdesk — disable MFA via support ticket

When implementing MFA:

• Default to requiring MFA for all users
• Offer multiple MFA options but make hardware keys and TOTP available
• Educate users on MFA fatigue — if they didn't initiate a login, deny the push
• Monitor for MFA bypass patterns in authentication logs

Which MFA method is phishing-resistant because it cryptographically binds authentication to the specific website?

MFA requires two factors from different categories (know/have/are). TOTP apps are good; hardware keys (FIDO2) are best — phishing-resistant. SMS OTP is weakest — vulnerable to SIM swapping. MFA fatigue attacks spam push notifications; number matching mitigates this. Passkeys combine hardware and biometrics into one seamless credential.