Home / Knowledge hub / MFA
Knowledge hub
MFA
A second proof beyond the password, usually a code or a hardware key.
What it means
Multi-factor authentication asks for a second proof alongside the password. A code from an app, a prompt on a phone, or a hardware key. The two proofs should differ in kind, something you know and something you hold, so stealing one does not deliver both.
Codes by text message count, and they are the weakest common option. NIST treats delivery over the phone network as restricted, and tells verifiers to watch for SIM changes and number porting before relying on it.
Why it matters
Passwords fail in bulk. People reuse them, they turn up in breach lists, and they get typed into convincing copies of your login page. A second factor turns a working password into a useless one for most attackers.
Most is not all. Phishing kits relay codes in real time, and repeated push prompts wear people down until somebody taps approve. CISA recommends phishing-resistant options such as hardware security keys for the accounts that matter. Those accounts approve payments, change payroll details and reset other people's passwords.
How it shows up
Gaps live at the edges rather than the front door. Legacy protocols still accepting a password alone. API tokens issued before the rule existed. A recovery flow that steps around the second factor with security questions. Administrators exempted because the extra step annoyed them.
Look hard at what happens when somebody loses their phone, because the recovery path sets the real security level of the whole arrangement. The Cyberlop console offers one-time codes today, with single sign-on through Okta. We write up how we build the platform in full.
Questions people ask
MFA, answered
Is SMS two-factor better than nothing?
Yes. A stolen password alone stops working, which removes the most common attack outright.
Treat it as a floor rather than a destination. SIM swaps and number porting are ordinary criminal services now, so anything holding money or personal data deserves a stronger factor.
Can MFA be bypassed?
It can. Phishing pages proxy the login in real time and capture the code as you type it. Attackers also swap SIMs, hijack sessions after login, and spam push prompts until somebody approves one.
None of that makes MFA pointless. It moves the attacker from a bulk, automated attack to a targeted one, which is a large change in your favour.
What counts as phishing-resistant MFA?
Methods bound to the site you are actually visiting, such as hardware security keys and passkeys. A fake page cannot use them, because the browser will not release the credential to the wrong domain.
Codes and push prompts do not qualify, since a convincing intermediary can relay both.
What happens when someone loses their phone?
Whatever your recovery flow allows, which is why that flow is the real control. Security questions and a friendly support agent undo the whole scheme.
Single-use recovery codes issued at enrolment, or a second registered factor, keep the standard high while still getting people back in.
Does MFA stop credential stuffing?
For the most part. Stuffing works by replaying leaked passwords at scale, and a second factor breaks the automation.
Watch the paths that skip it, though. An API that accepts a password alone, or a legacy protocol still enabled, lets the same attack through a side door.
Related
Terms that sit next to this one
TOTP
The six-digit code from an authenticator app, changing every thirty seconds.
Authentication
Proving you are who you say you are. It answers one question only.
Credential stuffing
Trying passwords leaked elsewhere, because people reuse them.
Account takeover
An attacker ends up signed in as one of your real users.
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Second factor on every door?
A second factor is worth little if one API path skips it. We test the authentication your application actually enforces and show you where it did not. Ask about a pilot on one application.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.