다중 요소 인증 및 계정 복구

Strong access control and good session management still rest on one assumption: the user is who they claim. Passwords alone are weak. Multi-factor authentication adds layers so a stolen password is not enough.

Authentication factors fall into categories:

• Something you know — password, PIN
• Something you have — phone, hardware key
• Something you are — fingerprint, face

MFA combines two or more different categories.

Time-based One-Time Passwords generate a 6-digit code from a shared secret and the current time. The server computes the same code to verify.

SMS codes are better than nothing but vulnerable to SIM swapping and interception. Prefer TOTP apps or hardware keys; reserve SMS as a last-resort option.

WebAuthn uses public-key cryptography with a hardware or platform authenticator. There is no shared secret to phish — the strongest widely available MFA.

What if a user loses their phone? Issue one-time backup codes at enrollment. Store them hashed, just like passwords, and invalidate each after use.

Account recovery often bypasses MFA. If recovery only needs an email link, an attacker who controls the inbox owns the account. Recovery must be as strong as login.

Recovery links should use a high-entropy, single-use, short-lived token, stored hashed and invalidated on use or password change.

• Do not reveal whether an email exists (enumeration)
• Rate-limit recovery requests
• Notify the user when recovery is initiated
• Require re-enrollment of MFA after a full reset

For sensitive actions — changing email, large transfers — require a fresh factor even within an active session. This step-up limits the damage of a hijacked session.

The MFA code entry is itself a target. A six-digit code has only a million possibilities, so without limits an attacker can brute-force it. Rate-limit and lock out after a few wrong codes, and expire each code quickly.

Test your MFA and recovery knowledge.

You strengthened authentication:

• MFA combines factors from different categories
• Prefer TOTP and WebAuthn over SMS
• Provide hashed backup codes
• Make recovery as strong as login with single-use, expiring tokens
• Use step-up auth for sensitive actions