MFA and 2FA

A criminal gets Sam's email password from a leak of an unrelated website where he reused it. Without anything else, they are now reading the shop's supplier emails. With a second factor, the stolen password alone gets them nowhere. Multi-factor authentication is one of the most effective single defences a small organisation can switch on.

The rule

Two different kinds of proof beat one secret, however strong.

MFA (multi-factor authentication) means logging in with factors from at least two different categories: know, have, are. 2FA is the common case of exactly two.

The "different" matters. A password plus a security question is still two things you know, and both can be stolen or guessed the same way. That is not true MFA.

Common second factors, from stronger to weaker:

• Hardware security keys and passkeys — tied to the real website, so they resist fake login pages.
• Authenticator app codes or push prompts — good; watch out for unexpected prompts and never approve one you did not start.
• SMS text codes — much better than nothing, but texts can be intercepted or the number hijacked by tricking the phone company.

Turn MFA on first where a takeover would hurt most: email (which can reset every other password), the cloud drive, the website admin, banking and the domain registrar.

The shortcut

To check if a login is really multi-factor, name the category of each proof. If two proofs fall in the same category, it is not MFA.

The trap is "MFA fatigue": an attacker with the password sends prompt after prompt, hoping a tired user taps Approve. Unexpected prompts are an alarm, not a nuisance.

Drills

Answer fast — trust the rule.

Remember

• Two different kinds of proof beat one secret, however strong.
• Name each proof's category; two of the same kind is not MFA.
• Trap: approving prompts you did not start. Protect email and admin accounts first.