Lessons · Cybersecurity · multi-factor authentication
Proving it is really you, twice
Multi-factor authentication asks for two different kinds of proof, something you know and something you have, so a stolen password on its own is not enough to get in.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The password was in a breach dump three years old. Somebody in another country typed it in at 4 a.m. and the login stopped at the prompt for the six-digit code on a phone that was on a bedside table. That is the story of most of the account takeovers that never happened.
How to think about it
MFA stops everything that only has the password: stuffing, guessing, a password read off a note. It does not stop somebody being talked into approving a prompt. Put it on the internet-facing systems first, and on administrator accounts before anything else.
Worked example
Factor 1: something you know, the passwordCan be copied without you ever noticing.
Factor 2: something you have, an app code or a hardware keyHas to be physically present, and a stolen list does not include it.
Rollout order: administrators, then email, then remote access, then everybodyHighest value first. Administrator accounts are the keys to every other lock.
What it does not stop: a user approving a prompt they did not startSo the rule is: a prompt you did not cause is a report, not an approval.
Your turn
An app code or a hardware key is a factor of which kind? Finish the phrase.
something you
Solve one, graded on the server
The trap
Counting a password and a security question as two factors. Both are things you know, and both are usually in the same breach dump.