Multi-factor authentication

Digital identity has long rested on a single line of defense: the password. But a password can be guessed, stolen, or replayed. Strong authentication seeks to combine several proofs of identity of different kinds.

What is an authentication factor?

A factor is proof that you are indeed the right person. Factors fall into three broad categories, according to what they rely on.

• Something you know: a memorized piece of information, such as a password, a PIN, a secret phrase.
• Something you have: a physical object, such as a phone, a security key, a smart card.
• Something you are: a biological characteristic, such as a fingerprint, a face, a voice.

+------------------+---------------------------+-------------------------+
| Category         | Examples                  | Main weakness           |
+------------------+---------------------------+-------------------------+
| Something I KNOW | password, PIN             | guessed, shared,        |
|                  |                           | replayed                |
+------------------+---------------------------+-------------------------+
| Something I HAVE | phone, key, card          | lost, stolen            |
+------------------+---------------------------+-------------------------+
| Something I AM   | fingerprint, face, voice  | not revocable once      |
|                  |                           | compromised             |
+------------------+---------------------------+-------------------------+

Why a single factor is no longer enough

A password alone is fragile. Database leaks expose billions of passwords, often reused from one site to another. Phishing tricks the user into entering it on a fake site. Once stolen, it grants full access.

The underlying problem: a single something I know factor is just a string of characters. Nothing distinguishes the true owner from an attacker who knows the same string.

Combining factors

Two-factor authentication (2FA), or more generally multi-factor authentication (MFA), requires proofs drawn from different categories.

A classic example: a password (something I know) plus a code read on the phone (something I have). An attacker who has stolen the password through a leak does not have the phone: they are blocked.

An important point: two passwords do not make strong authentication. You need two distinct categories. Adding together two something I know proofs leaves the same weakness.

The right trade-off

Adding a factor strengthens security but makes usage heavier. Too much friction, and the user works around the protection. 2FA is today the dominant trade-off: a major security gain for a moderate effort, in particular against password leaks.

In summary

• A factor belongs to one of three categories: something I know, something I have, something I am.
• Strong authentication combines factors from different categories.
• 2FA makes a stolen password insufficient, because the second factor is missing.