Multi-factor authentication (MFA)
MFA · 2FA · two-factor authentication · two-step verification · strong authentication · authentification multifacteur · double authentification
A login that requires at least two proofs of identity of different kinds (something you know, something you have, something you are), so that a stolen password is no longer enough.
In practice
The second factor can be a code sent by text message, a code generated by an app, a push notification to approve, a physical security key or a passkey. They are not equal: text messages can be hijacked (SIM swapping), and both codes and push notifications can be relayed by a fake login page or extracted through sheer persistence (“MFA fatigue”). Phishing-resistant methods, FIDO2 keys and passkeys, are bound to the genuine site and defeat these relays. ANSSI, the French national cybersecurity agency, recommends multi-factor authentication and favours possession factors.
Real case: in September 2022, an attacker holding the password of an Uber contractor, probably bought after the contractor’s personal device was infected with malware, kept sending login approval requests until the contractor accepted one. The attacker then reached other internal accounts (source: Uber, 19 September 2022).
How to protect yourself
- Turn on MFA first for email, VPN, administrator access and cloud tools.
- Prefer passkeys or FIDO2 keys; failing that, an app with number matching.
- Alert on bursts of requests and teach staff to refuse any request they did not start.
