What is MFA?
Multi-Factor Authentication, told as a story about a gatekeeper who asks three different questions.
The old gatekeeper only asked for the password.A password can be overheard.
Passwords keep leaking.Written on notes, reused at every castle, overheard.
MFA asks two or more questions of different kinds.Something you know, something you have, something you are. One can leak; the others still hold.
Steal the password, and you still have no ring.Stealing two different things at once is much harder.
Even the ring can be fooled by a fake gate.Read the code aloud and the thief uses it at the real gate. That's why newer rings recognize the gate themselves (passkeys).
MFA = the gatekeeper checks two or more things of different kinds: know, have, are.
Multi-Factor Authentication. With exactly two, it's 2FA. A texted 6-digit code is the most common 'have'; a passkey is a ring that can't be fooled by a fake gate.
When grown-ups say it
- Something you know
- The password. Lives only in your head. Leaks the easiest.
- Something you have
- The ring. Your phone, an authenticator app, a security key. To steal it, they need the object.
- Something you are
- Face, fingerprint. Attached to you. Can't be changed — a strength and a weakness.
- 2FA
- Two of them. MFA with exactly two kinds.
- One-time password
- A number used once. The ring makes a fresh one each time — every 30 seconds, or by text.
- Phishing
- The fake gate. A door that looks real, collecting your password and code. → T1566 in the encyclopedia
- Passkey (FIDO2)
- A ring that knows the gate. Only works at the real gate. Does nothing at a fake one.
- MFA fatigue
- Asked so often you just say yes. A thief rings the ring all night until you tap yes half asleep.