MFA
Multi-Factor Authentication. Requiring two or more factors from distinct categories: something you know (password), something you have (token), something you are (biometric). Not all MFA is equal, TOTP and SMS are phishable, FIDO2 is not.
The word MFA now covers methods with a security gap of several orders of magnitude, which is why policies that just say "require MFA" keep failing. SMS codes, app-generated codes, and push approvals are all relayed by commodity phishing kits in real time. Origin-bound credentials are not. When you write a policy or a compliance control, name the method class, not the acronym.
See also: phishing-resistant MFA, passkey, AAL, MFA vendors
Related on Start with Identity
- GlossaryPasswordless
Authentication without a password as a primary factor. Implementations include magic links, OTP codes, and passkeys. Passkeys are the only passwordless method t
- CVEVault TOTP login MFA bypass
Vault's TOTP login MFA could be bypassed. Companion to the LDAP MFA bypass in the VaultFault set. Confirm the score against NVD; vendor and researcher figures c
- GlossaryFIDO2
FIDO2 is a set of specifications from the FIDO Alliance plus W3C. It combines WebAuthn (the browser API) with CTAP (the client-to-authenticator protocol) to ena
- GlossaryHOTP
HMAC-based One-Time Password (RFC 4226). A counter-based one-time code and the basis for TOTP. Largely superseded by time-based codes and phishing-resistant met
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.