Multi-factor authentication

It is hard to stay safe online.

You can use two things to lock your apps. This is called two-factor authentication.

One way is to use a secret word. This is a password.

Another way is to use a phone. The phone gets a special code.

You can also use a small tool. It might look like a USB stick.

You can even use your finger.

Using two things keeps your data safe. It makes it hard for bad people to get in.

Do you use a secret word and a code?

It is hard to stay safe online. One way to help is by using multi-factor authentication. This is also called MFA.

It is a way to prove who you are. To log in, you must show two or more types of proof. This keeps your data safe from people who might steal a password.

There are different ways to prove your identity. One way is something you know. This could be a secret word or a PIN.

Another way is something you have. You might use a bank card or a security token. A security token is a small tool like a USB stick. Some tokens have a screen to show a code. You can also use a mobile phone to get a code.

A third way is something you are. These are called biometrics. This means using parts of your body. You might use a fingerprint or your voice. Some systems even use your eyes. Using more than one step makes it much harder for hackers to get in.

Multi-factor authentication, often called MFA, is a way to keep digital information safe.

It helps protect your personal data and money from people who are not allowed to see them. Sometimes, a person might find out a single password. If that happens, MFA can still block them from getting in. This method requires you to show two or more different types of proof. This extra step makes it much harder for an unauthorized person to access your accounts. Using MFA makes it much less likely that your accounts will be compromised.

How does this way of working actually happen? First, you provide one piece of evidence, like a password. Then, you must provide a second, different type of proof. There are three main types of proof used in this process. The first is something you know, like a secret PIN or a passphrase. The second is something you have, such as a physical security token or a bank card. The third is something you are, which uses your body, like a fingerprint or your voice. If even one part is missing or wrong, the system keeps the door locked.

People have used different types of proof for a long time. Using a physical object like a key to a lock is a way of using possession for centuries. In the digital world, things have changed quickly. In 1996, AT&T described a system that used pagers to send codes for transactions. Later, in 2011, a company called Duo Security began offering push notifications through mobile apps. By 2016 and 2017, big companies like Google and Apple started offering two-step authentication with these notifications. Now, many devices use special standards like FIDO2 to make this process easier for everyone.

There are many different tools used for MFA today.

You might use a hardware token, which is a physical device like a USB stick. Some tokens are disconnected and have a small screen to show a code. Other tokens are connected directly to your computer to send data automatically. You can also use a smartphone as a "soft token." This is a piece of software that generates a time-based one-time password, or TOTP. These codes change constantly so they are very hard to guess or steal.

Think about how you use an ATM to get money.

You usually need to use a bank card that you carry with you. Then, you must also type in a secret PIN that only you know. This is a perfect example of two-factor authentication in real life. You are using something you have and something you know at the same time. This same idea is used every day to protect websites and apps. It turns a single lock into a much stronger system of many locks.

Multi-factor authentication, or MFA, is a digital security method used to protect sensitive information. It ensures that a user is only granted access to a website or application after presenting two or more distinct types of evidence. These pieces of evidence are known as authentication factors. MFA is vital because it protects personal data, such as financial assets or private identification, from unauthorized third parties. Even if a hacker discovers a single password, MFA provides a critical layer of defense. Accounts that have MFA enabled are significantly less likely to be compromised by attackers.

The mechanism of MFA relies on the premise that an unauthorized actor is unlikely to possess all required factors. When a user attempts to log into a computer resource, such as a network or an application, the system requires proof of identity. This process involves a claim of identity and evidence to support that claim. In simple authentication, only one factor is used, like a password. However, in MFA, the system checks multiple types of evidence. If even one component is missing or entered incorrectly, the identity is not established. Consequently, access to the protected asset remains blocked.

There are three primary categories of authentication factors used in these systems. The first is something the user knows, which refers to knowledge factors. This includes secrets like passwords, PINs, or longer passphrases. The second category is something the user has, known as possession factors. This includes physical objects like a bank card, a USB security token, or a smartphone. The third category is something the user is, which involves inherent factors. These are biometrics, such as a fingerprint, an eye iris scan, or even voice recognition. Some systems even use behavioral biometrics, like the specific pattern of how a person types.

Possession factors can be divided into hardware and software versions. Hardware tokens are physical devices, such as a USB stick or a smart card. Some are disconnected tokens, which have a built-in screen to display authentication data that the user must type in manually. Others are connected tokens that transmit data automatically to the computer. A software token, or soft token, is different because it is stored on a general-purpose device like a laptop or a mobile phone. While hardware tokens are difficult to duplicate, soft tokens can be duplicated. An example of a soft token is an authenticator app that generates a Time-based One-Time Password, or TOTP.

Mobile phone-based authentication has become a very popular method for modern users. This can include SMS-based verification, where a code is sent via text message. It can also include push-based authentication, where a user approves a login through a mobile app. While convenient, SMS verification has security concerns. For example, phones can be cloned, and attackers can use SIM swapping to intercept messages. In 2016, the United States NIST proposed deprecating SMS as an authentication method. However, they reinstated it as a valid channel in their finalized guidelines a year later.

The history of these technologies shows a long evolution of security. Possession factors, like using a physical key for a lock, have been used for centuries. In the digital realm, AT&T described a system for authorizing transactions using pagers as early as 1996. In 2011, Duo Security began offering push notifications for MFA via mobile apps. By 2016 and 2017, major companies like Google and Apple began offering two-step authentication with push notifications. Additionally, FIDO2 capable tokens became more popular due to mainstream browser support starting in 2015.

Beyond digital accounts, MFA is also applied to physical security through access control systems. In these settings, a user might first present a physical possession, such as a keycard or a QR code. They must then provide an inherent factor, such as facial verification or a retinal scan. Some advanced systems even consider a fourth factor: location. For example, a user might only need a PIN if they are working from a secure, hard-wired corporate network. If they are working remotely, the system might require a more secure method, such as a soft token. This allows security levels to change dynamically based on where the user is located.