practice

Multi-Factor Authentication

also called MFA, 2FA

Requiring evidence from more than one category — something you know, have, or are — so a single stolen credential is insufficient.

The categories matter more than the count, and the strength varies enormously between implementations of the same nominal "second factor".

SMS codes — better than nothing and the weakest common option. Vulnerable to SIM swap, SS7 interception and, above all, phishing: a user will read the code to a convincing attacker.

TOTP apps — no SIM swap exposure, still phishable in real time. An attacker proxying the login collects the code and uses it within its window.

Push approval — convenient, and vulnerable to MFA fatigue, where an attacker triggers repeated prompts until someone approves to stop the noise. Number matching mitigates it.

Passkeys / FIDO2 / WebAuthnphishing-resistant, because the credential is cryptographically bound to the origin. A user on a lookalike domain cannot authenticate to the real one no matter how convincing the page is. This is a categorical difference, not an incremental improvement.

The architectural conclusion: if MFA is being introduced now, introduce the phishing-resistant kind. It is stronger and lower friction — a biometric rather than typing a code from another device — which is the rare case where the security and usability objectives point the same way.