Background: multi-factor authentication

Multi-factor authentication (MFA), also known as two-factor authentication (2FA), is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting two or more distinct types of evidence (or factors) to an authentication mechanism. MFA protects personal data—which may include personal identification or financial assets—from being accessed by an unauthorized third party that may have been able to discover, for example, a single password.

Usage of MFA has increased in recent years. Security issues which can cause the bypass of MFA are fatigue attacks, phishing and SIM swapping.

Authentication factors

Authentication takes place when someone tries to log into a computer resource (such as a computer network, device, or application). The resource requires the user to supply the identity by which the user is known to the resource, along with evidence of the authenticity of the user's claim to that identity. Simple authentication requires only one such piece of evidence (factor), typically a password, or occasionally multiple pieces of evidence all of the same type, as with a credit card number and a card verification code (CVC).

For additional security, the resource may require more than one factor—multi-factor authentication, or two-factor authentication in cases where exactly two types of evidence are to be supplied.

An example of two-factor authentication is the withdrawing of money from an ATM; only the correct combination of a physically present bank card (something the user possesses) and a PIN (something the user knows) allows the transaction to be carried out. Two other examples are to supplement a user-controlled password with a one-time password (OTP) or code generated or received by an authenticator (e.g. a security token or smartphone) that only the user possesses.

An authenticator app enables two-factor authentication in a different way, by showing a randomly generated and constantly refreshing code, rather than sending an SMS or using another method. This code is a Time-based one-time password (a TOTP), and the authenticator app contains the key material that allows the generation of these codes.

Knowledge

Knowledge factors ("something only the user knows") are a form of authentication. In this form, the user is required to prove knowledge of a secret in order to authenticate.

Possession

Possession factors ("something only the user has") have been used for authentication for centuries, in the form of a key to a lock. The basic principle is that the key embodies a secret that is shared between the lock and the key, and the same principle underlies possession factor authentication in computer systems. A security token is an example of a possession factor.

Disconnected tokens have no connections to the client computer. They typically use a built-in screen to display the generated authentication data, which is manually typed in by the user. This type of token mostly uses a one-time password that can only be used for that specific session.

Connected tokens are devices that are physically connected to the computer to be used. Those devices transmit data automatically. There are a number of different types, including USB tokens, smart cards and wireless tags. Increasingly, FIDO2 capable tokens, supported by the FIDO Alliance and the World Wide Web Consortium (W3C), have become popular, with mainstream browser support beginning in 2015.

Inherent

Inherent factors ("something the user is"), are factors associated with the user, and are usually biometric methods, including fingerprint, face, voice, or iris recognition. Behavioral biometrics such as keystroke dynamics can also be used.