Why it matters
Passwords leak, get reused and get phished. With MFA, an attacker who has the password still has to get past a second proof. It is one of the most effective and least costly protections for accounts, and it matters most on administrator accounts, email and anything that holds money or personal data.
The three kinds of factor
| Factor | Examples |
|---|---|
| Something you know | A password or a PIN |
| Something you have | A phone with an authenticator app, or a hardware security key |
| Something you are | A fingerprint or a face scan on a device |
Two passwords are not MFA, because both are the same kind of factor.
Which methods are stronger
- Security keys and passkeys, built on WebAuthn, are the strongest common choice. They are bound to the real site, so they resist phishing.
- Authenticator apps generate time-based codes. They are good, but a user can still be tricked into typing a code on a fake page.
- Push approvals are easy to use, but an attacker can flood a user with prompts until one is approved.
- SMS codes are better than nothing, yet they can be intercepted or redirected through a SIM swap.
Common mistakes
- Protecting customer sign-in and forgetting admin and staff accounts.
- A recovery flow, such as lost my phone, that bypasses the second factor and becomes the weak spot.
- No limit on wrong code attempts.
- Requiring MFA with no backup method, which locks out real users.
Related terms
MFA addresses authentication failures, a recurring theme in the OWASP Top 10. Deciding where to require it is a natural output of threat modelling. See also the secure app development guide.