Browse
Multi-Factor Authentication Design
Combining independent authentication factors, and why some MFA methods are meaningfully stronger than others.
What it is
MFA requires two or more independent factors to authenticate — something you know (password), something you have (a device/token), something you are (biometrics) — so compromising one factor alone isn't enough.
Key points
- Not all MFA is equally strong: SMS-based codes are vulnerable to SIM-swapping and are the weakest common factor; authenticator app TOTP codes are stronger; hardware security keys (FIDO2/WebAuthn) are the strongest, resistant to phishing.
- Phishing resistance is the key differentiator among MFA methods today — a code the user types in (SMS, TOTP) can be phished and relayed by an attacker in real time; a hardware key that's cryptographically bound to the specific site cannot.
- Adaptive/risk-based MFA: prompting for a second factor based on risk signals (new device, unusual location) rather than every single login, balancing security against user friction.
- MFA significantly reduces account takeover risk from credential leaks, but design choices among MFA methods still matter — not every implementation provides the same actual protection.