Multi-factor authentication

Multi-factor authentication verifies an identity using evidence from at least two independent categories: knowledge, possession, or inherence. Independence distinguishes it from using multiple credentials of the same type.

Authentication factor: A category of evidence used to verify identity, commonly knowledge, possession, or inherence. MFA requires evidence from at least two distinct factor categories.
Two-factor authentication: A form of multi-factor authentication requiring exactly two distinct categories of evidence. It is the most familiar case of MFA, but MFA also includes three or more factors.
Hardware security key: A physical authenticator that proves possession, often through public-key cryptography. Security keys provide a strong second factor and resist many remote phishing attacks.
Credential stuffing: An account takeover attack that tests stolen username-password pairs across other services. A separate factor can block attackers whose reused passwords are already known.
Time-based one-time password: A short-lived code generated from a shared secret and the current time. Authenticator apps commonly supply a possession factor through these rotating codes.
Two-step verification: A sign-in process requiring two sequential checks, which may or may not use different factor categories. Two steps qualify as MFA only when they use independent factor types.
Authenticator app: An application that generates one-time codes or approves sign-in requests on a device. It gives users a software-based possession factor for accounts that support MFA.
Phishing: A deceptive attempt to obtain information or induce actions by impersonating a trusted source. Some MFA methods can be relayed or tricked through real-time phishing sites.
WebAuthn: A web standard for public-key authentication using authenticators such as security keys and platform biometrics. It enables phishing-resistant MFA without shared passwords or manually entered codes.
Single-factor authentication: Identity verification that relies on evidence from only one factor category. A password plus a security question still falls short when both depend on knowledge.

Linked from 6 pages