What is Multi-factor authentication?

Authentication that verifies a person by combining two or more different factors among knowledge (such as a password), possession (such as a smartphone or smart card) and inherence (such as a fingerprint or face). Even if the password leaks, logging in is impossible without the other factors. Also called MFA.

Japanese name: 多要素認証

Multi-factor authentication appears in 6 practice questions across 1 topic, including Information Security Basics.

Field: Information Security Basics

The three authentication factors

Authentication factors are divided into something only the person knows (knowledge: passwords, PINs, security questions, etc.), something only the person has (possession: smartphones, smart cards, dedicated authentication devices, etc.) and characteristics of the person's body or behavior (inherence: fingerprints, face, vein patterns, voice, etc.). Because multi-factor authentication combines different kinds of factors, an attacker who steals one factor still cannot log in without obtaining the others.

Examples that are not multi-factor

Combining a password with a security question is not multi-factor authentication even though it checks twice, because both are knowledge factors (it is sometimes called two-step verification). Factors of the same kind can be stolen together by the same method, such as phishing. Conversely, a method in which the smartphone's fingerprint sensor unlocks a key stored in the device is multi-factor authentication, combining possession of the device with inherence.

Differences in strength between methods

Verification codes sent by SMS and one-time passwords shown by an app are far more secure than passwords alone, but they cannot fully stop attacks that get users to enter them on a fake site in real time (real-time phishing). Methods such as FIDO2 passkeys, which use a private key inside the device to create a signature bound to the site being accessed, do not work on fake sites and are therefore considered phishing-resistant; as of the mid-2020s their use is spreading.

Try it: questions about Multi-factor authentication

Which of the following authentication methods is multi-factor authentication?

AEntering a password and then entering a one-time password shown in an app on the user's own smartphone
BEntering a password and then also entering the answer to a security question
CEntering a more complex password that is twice as long

Show answer and explanation

Answer: A. Entering a password and then entering a one-time password shown in an app on the user's own smartphone

Multi-factor authentication combines two or more different factors among knowledge, possession and inherence. A password (knowledge) combined with a one-time password generated on the user's own smartphone (possession) uses two different factors, so it is multi-factor authentication. Even if the password leaks, an attacker cannot log in without the user's smartphone. A password and a security question are both knowledge factors, so even though they are checked in two steps, this is not multi-factor authentication (it is sometimes called two-step verification). Stacking factors of the same kind means they can be stolen together by the same method, such as tricking the user through phishing. One-time passwords can also be abused by attacks that get the user to enter them on a fake site in real time, so, as of the mid-2020s, methods with which authentication does not work on a fake site (such as FIDO2 passkeys) are spreading.

FAQ

What is the difference between two-step verification and multi-factor authentication?

Two-step verification means there are two stages of checking, regardless of the kind of factor. Multi-factor authentication means combining factors of different kinds among knowledge, possession and inherence. Entering an SMS code after a password counts as both.

If I set up multi-factor authentication, can my password be simple?

No. Multi-factor authentication is a mechanism for staying protected even if one factor is broken, and it is safer the stronger each factor is. Use a long, hard-to-guess password and do not reuse it with other services.

Multi-factor authentication in the explanations

Multi-factor authentication combines two or more different factors among knowledge, possession and inherence.
Which of the following authentication methods is multi-fact…
Dictionary words and reused passwords are found far sooner than by brute force, so it is important to use long, random passwords and, on the service side, to combine slow hashing, limits on login attempts and multi-factor authentication.
An 8-character password is searched for by brute force, try…
Because a lost or stolen card could be used by someone else, possession factors are often combined with knowledge such as a PIN, which makes it multi-factor authentication.
Of the three factors of authentication used to verify a use…
However, if the IdP account is taken over, the attacker gets into every linked service, so multi-factor authentication at the IdP is especially important.
Which statement correctly describes single sign-on (SSO)?
The core defenses are applying fixes for vulnerabilities that attackers use to get in, multi-factor authentication for remote access, minimizing privileges, and backups kept somewhere disconnected from the network.
Which statement correctly describes ransomware?

Questions that mention Multi-factor authentication (6)

Books on Information Security Basics Ad

Search Amazon for semiconductor Information Security Basics

As an Amazon Associate I earn from qualifying purchases.

Semiconductor, Electronics and Computing Calculators

Password Brute-Force Time CalculatorCompute the number of combinations and the entropy from the character set and length, and estimate brute-force time

Back to the glossary