Факторы аутентификации и многофакторная аутентификация

Authentication asks "are you really you?" — and answers it by checking authentication factors, pieces of evidence tied to your identity.

Every factor fits one of three categories: something you know, something you have, or something you are.

Knowledge factors are secrets you remember — passwords, PINs, security answers. Cheap, but easily phished, guessed, or reused.

Possession factors are things you hold: a phone getting a code, a hardware key, or an authenticator app spitting out rotating codes like this one.

Inherence factors are biometrics — fingerprint, face, voice. Convenient and hard to share, but you can't change them once compromised.

Leaning on a single factor, usually a password, is fragile — one leak hands over full access. Most major breaches trace back to single-factor logins.

Multi-factor authentication requires factors from two or more different categories. Password plus phone code is MFA; two passwords is not — both are knowledge.

MFA is stronger because an attacker must defeat several independent factors at once — stealing your password and your phone — making remote attacks far harder.

A TOTP is a common possession factor: the server and app share a secret and both compute the same code, which rotates every 30 seconds.

Modern logins cut friction with push approvals on a trusted device and passkeys — combining a device (have) with biometrics (are) to resist phishing.

Adaptive authentication asks for extra factors only when risk spikes — a new device or odd location — balancing security against user convenience.

A login requires a password and a fingerprint. Why does this count as multi-factor?

Recap: the three factor categories are know, have, and are. Password-only is weak; MFA mixes categories, and TOTP, passkeys, and adaptive auth raise the bar.