Multi-Factor Authentication (MFA) - Why It Matters

About 2 min read

Multi-factor authentication (MFA) is a method of verifying identity by combining two or more different factors during authentication. By combining several categories among knowledge factors (passwords), possession factors (smartphones, security keys), and inherence factors (fingerprints, faces), it significantly strengthens security. In a 2019 article, Microsoft stated that MFA can block over 99.9% of account compromise attacks. An empirical study published by the company's researchers in 2023 reported that MFA reduces the risk of compromise by 99.22% across the population studied, and by 98.56% in cases where credentials had already been leaked. Google and Apple are also working to enable MFA by default in their own services.

Real-World Use Cases

When an organization makes MFA mandatory, it is more realistic to work in order of potential damage than to switch every account at once. For example, hand out FIDO2 security keys to administrator accounts first, and only then roll approval notifications out to general employees. Administrators come first because an account takeover there lets the attacker change the settings of other people's accounts as well. The factors themselves are not equally strong either: an SMS one-time code can be bypassed by hijacking the phone number, whereas a security key defeats the trick of luring you into typing a code on a fake site. The same logic works for individuals: add MFA first to the accounts that act as the gateway for resetting everything else, namely your email and your password manager.

Comparison of Authentication Factors

The Three Authentication Factors and Practical Choices

Knowledge factors prove "something you know," such as passwords or PINs; possession factors prove "something you have," such as smartphones or hardware tokens; and inherence factors prove "something you are," such as fingerprints or faces. In practice, SMS authentication is vulnerable to SIM swapping attacks, so TOTP apps (Google Authenticator, Authy) and FIDO2 security keys (YubiKey) are recommended instead. In particular, for financial institutions and administrator accounts, you should choose TOTP or hardware keys.

The Difference from Two-Step Verification (2FA)

Two-step verification (2FA) refers to "authenticating in two steps," while MFA refers to "authenticating with two or more different factors." For example, a method that asks a security question after entering a password is two steps, but since both are knowledge factors, it cannot be called MFA. A combination of a password and a TOTP code is a knowledge factor plus a possession factor, so it is two-step verification and at the same time MFA. From a security standpoint, combining factors from different categories is more important than the number of steps.

Key Points for Deploying and Operating MFA

Combining a sufficiently long, random password (a knowledge factor) with a TOTP app or security key (a possession factor) achieves robust multi-factor authentication. A key consideration during deployment is the secure storage of recovery codes. To prepare for the loss or failure of a device, always set up a backup authentication method. In corporate environments, it is effective to make MFA mandatory across the entire company together with a password policy, and to inform employees about the two-step verification setup guide.