Multi-factor authentication (MFA)

What is multi-factor authentication in simple words

Multi-factor authentication (MFA) is a method of identity verification in which logging into a system requires confirmation from different protection categories, not just a login and password. It is like two locks on a door: even if an attacker picks the key to one lock, the second one will stop them.

The classic example is withdrawing cash at an ATM: to get money, you must insert a physical card (something you have) and enter a PIN code (something you know). In the digital world, MFA works on the same principle.

According to Microsoft statistics, using MFA blocks up to 99.9% of automated attacks and significantly reduces the risk of account compromise. Despite this, only about 30% of users enable two-factor authentication on their accounts. Read about other protection methods in the article Information security.

Three main authentication factors

Three main types of factors are used for authentication, which can be combined to create multi-factor protection:

• Knowledge (something you know): Password, PIN code, answer to a secret question, code word. The most common, but also the most vulnerable factor — passwords can be guessed, stolen or caught sight of.
• Possession (something you have): One-time code from SMS, push notification to a smartphone, authenticator application (Google Authenticator, Yandex Key), physical USB token (YubiKey, Rutoken) or smart card. This significantly increases security, since an attacker needs to physically take possession of your device.
• Inherence (something you are): Biometric data — fingerprint, face scanning (Face ID), retina scan, voice or behavioral patterns. The most difficult factor to forge.

How MFA differs from 2FA

These terms are often confused, but there is an important difference between them:

• 2FA (two-factor authentication): Uses exactly two factors from different categories (for example, password + SMS code). This is a special case of MFA, the most common in practice.
• MFA (multi-factor authentication): Uses two or more factors (for example, password + fingerprint + push notification). MFA can include three or more factors, which provides the maximum level of security.

Read about the difference between authentication and authorization in the article Authentication.

How MFA works in practice

The typical multi-factor authentication process when logging into an account looks like this:

1. You enter your login and password (Factor No. 1 — Knowledge).
2. The system sends a code to your phone via SMS, a push notification, or generates a code in the authenticator application (Factor No. 2 — Possession).
3. You enter the received code or confirm the login in the application.
4. Login is allowed only after both stages are successfully passed. If an attacker stole your password but has no access to your phone — they will not be able to log in.

Read about MFA setup in the article OAuth.

Methods of implementing MFA

There are several methods of implementing MFA, each with its own advantages and disadvantages:

• SMS and voice calls: The simplest and most popular way. The code comes to the phone via SMS or a voice call. Disadvantage — vulnerability to SIM swapping (when an attacker reissues a SIM card) and message interception.
• Authenticator applications: Google Authenticator, Microsoft Authenticator, Authy, Yandex Key. Generate codes on the device, do not require the internet. Safer than SMS, since codes are not transmitted over the network.
• Push notifications: The application sends a request to confirm login. It is enough to press “Yes” on the smartphone. Convenient and fast, but requires the internet on the device.
• Hardware keys (U2F): Physical devices (YubiKey, Rutoken). The most reliable way — the key is physically connected to a USB port or via NFC. Resistant to phishing and remote attacks. Used in Google and other large companies.
• Biometrics: Fingerprint, Face ID, iris scanner, voice biometrics. Convenient and safe, but requires a biometric sensor on the device.

Read about biometric security in the article Biometrics.

Risks and limitations of MFA

Despite its high effectiveness, MFA has some limitations that are important to consider:

• Dependence on devices: If you lose the phone with the authenticator or SIM card, access may be lost. Always save the backup recovery codes that are issued when MFA is set up.
• SIM swapping: An attacker can reissue a SIM card through the operator and intercept SMS with codes. Therefore, SMS codes are considered the least reliable method.
• Phishing: Fake websites can imitate a request for a second factor. For example, an attacker can create a fake login page that requests an SMS code and intercepts it. Using hardware keys (U2F) protects against this.
• Inconvenience: Requires additional time and actions on every login. However, this small inconvenience is compensated by a significant increase in security.

Read about digital hygiene in the article Digital footprint.