MFA
acronymsecurityprivacy
Stands for: Multi-Factor Authentication
Requiring two or more independent proofs of identity to log in, not just a password.
Multi-Factor Authentication combines something you know (a password) with something you have (a phone or key) or are (a fingerprint), so a stolen password alone is not enough. It is one of the single most effective defences against account takeover.
The reason MFA became mandatory rather than recommended is arithmetic. Passwords are reused, phished, and dumped in breaches at a scale that no complexity policy fixes, so the industry stopped trying to make the first factor strong and added a second one instead.
Not all second factors are equal, and the ranking matters. SMS codes are better than nothing but vulnerable to SIM swapping and interception. Time-based codes from an authenticator app are substantially better, since the shared secret never travels. Hardware security keys using WebAuthn are better still, because the key verifies the site's origin and simply will not authenticate to a lookalike domain, which defeats phishing rather than merely discouraging it.
The attacks have adapted to the defence. Push fatigue, where an attacker triggers approval prompts until an exhausted user taps yes, and real-time relay through a proxy that forwards the code as it is typed, both defeat factors that a user must actively hand over. This is the underlying lesson: any factor that a human can be persuaded to relay can be relayed by a human under pressure.
Also known as: mfa, 2fa, two-factor, multi-factor authentication, totp