MFA
MFA (multi-factor authentication) is sign-in that requires two or more factors from different categories: something you know (a password or PIN), something you have (an MFA device such as a phone or security key) or something you are (a biometric). NIST SP 800-63B-4 grades MFA by Authenticator Assurance Level (AAL) and requires verifiers to offer at least one phishing-resistant option at AAL2.
| MFA method | Phishing-resistant? |
|---|---|
| SMS or voice code (a NIST "restricted" authenticator) | No |
| Authenticator app code (TOTP) | No |
| Push approval, even with number matching | No |
| Passkey or FIDO2 security key | Yes |
| PIV or CAC smart card | Yes |
The word MFA now covers methods with a security gap of several orders of magnitude, which is why policies that just say "require MFA" keep failing. SMS codes, app-generated codes, and push approvals are all relayed by commodity phishing kits in real time. Origin-bound credentials are not. When you write a policy or a compliance control, name the method class, not the acronym.
See also: phishing-resistant MFA, passkey, AAL, MFA vendors, two-factor authentication (2FA)
Related on Start with Identity
- GlossaryOne-Time Password (OTP)
A one-time password (OTP) is a code that is valid for a single sign-in or transaction, either generated by an authenticator from a shared secret, as in HOTP ([R
- GlossaryPassword Manager
A password manager is software that generates, stores and fills in a distinct, strong password for every account, keeping them in an encrypted vault opened with
- GlossaryPasswordless
Authentication without a password as a primary factor. Implementations include magic links, OTP codes, and passkeys. Passkeys are the only passwordless method t
- CVEVault login MFA rate-limit bypass and TOTP reuse
Vault's login MFA rate limits could be bypassed and TOTP codes reused, weakening the second factor. Part of the 2025 VaultFault set with the LDAP MFA bypass in
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.