Multi-Factor Authentication (MFA) requires users to present multiple independent evidence factors (something you know, something you have, or something you are) before logging in.
1. MFA Types
- SMS-Based MFA: Convenient but vulnerable to SIM-swapping and intercept attacks.
- TOTP (Time-Based One-Time Password): Uses a shared secret seed and the current time to generate temporary codes (e.g. Google Authenticator). Resistant to basic interceptions but vulnerable to active phishing.
- FIDO2 / WebAuthn (Hardware Keys): Uses cryptographically signed handshakes. The most secure form of MFA, immune to phishing attacks.
2. Auditing MFA Weaknesses
MFA can sometimes be bypassed via “MFA Fatigue” (bombarding a user with push notifications until they approve) or session hijacking (stealing active login cookies).