MFA / 2FA

Multi-Factor Authentication (MFA) requires users to present two or more pieces of evidence to verify their identity. Two-Factor Authentication (2FA) is a subset requiring exactly two factors. MFA dramatically reduces account takeover risk.

Category: Security

Author: Atomic Glue Security Team

## Definition

MFA is an authentication method that requires users to provide multiple verification factors to gain access to an account or application. Factors fall into three categories: something you know (password, PIN), something you have (phone, hardware token, authenticator app), and something you are (fingerprint, face scan, voice pattern). 2FA uses exactly two factors, typically a password plus a time-based one-time code (TOTP) or push notification. MFA is the single most effective control against credential theft and account takeover, blocking over 99.9% of automated attacks according to Microsoft.

## Types of Second Factors

**TOTP (Time-Based One-Time Password)**: Apps like Google Authenticator, Authy, 1Password generate 6-digit codes that change every 30 seconds. Works offline. **SMS codes**: Texted codes. Widely used but vulnerable to SIM swapping and SS7 attacks. NIST no longer recommends SMS as an out-of-band factor. **Push notifications**: Sent to a trusted device. User approves or denies. Works online only. **Hardware security keys**: USB/NFC devices (YubiKey, Google Titan) that use FIDO2/WebAuthn. Phishing-resistant. **Biometrics**: Fingerprint, Face ID, Windows Hello. Convenient but cannot be reset if compromised.

## Why MFA Matters

Passwords alone are insufficient. Users reuse passwords, fall for phishing, and have their credentials leaked in breaches. According to Microsoft, MFA blocks 99.9% of account compromise attacks. Many compliance frameworks (SOC 2, GDPR, HIPAA, PCI DSS) require MFA for privileged access. Major platforms (Google, Apple, Microsoft) now enforce or strongly encourage MFA for all users.

## MFA Fatigue and Best Practices

MFA fatigue (or push bombing) is an attack where the attacker repeatedly sends push notification requests to the victim, hoping they eventually approve out of annoyance. Mitigations include: number matching (the push shows a number that must be typed on the phone), requiring a physical action for hardware keys, and rate-limiting push requests. The most phishing-resistant MFA is FIDO2/WebAuthn using hardware security keys or passkeys.

## Note

SMS-based 2FA is better than no 2FA, but NIST deprecates it. TOTP apps or hardware keys are strongly preferred. The gold standard for phishing resistance is WebAuthn/FIDO2.

## Common questions

Q: Is 2FA the same as MFA?

A: 2FA is a subset of MFA. MFA requires two or more factors. 2FA requires exactly two. In practice, the terms are often used interchangeably.

Q: Can MFA be bypassed?

A: Yes. MFA fatigue attacks, SIM swapping (SMS), social engineering of help desks, and malware on the device can bypass MFA. Hardware security keys are the most resistant to bypass.

Q: Does MFA require a phone?

A: Not necessarily. TOTP apps work on any device. Hardware security keys work without a phone. Biometrics are device-native. SMS requires a phone, but it is the least secure option.

## Key takeaways

• MFA requires two or more authentication factors. 2FA requires exactly two.
• MFA blocks 99.9% of automated account compromise attacks.
• SMS-based 2FA is better than nothing but is deprecated by NIST.
• FIDO2/WebAuthn hardware keys provide the strongest phishing resistance.

## Related entries

• [Authentication vs Authorization](atomicglue.co/glossary/authentication-vs-authorization-backend)
• [Passkeys / WebAuthn](atomicglue.co/glossary/passkeys-webauthn)
• [SSO](atomicglue.co/glossary/sso)

Last updated December 2024. Permalink: atomicglue.co/glossary/mfa-2fa