Authentication Factors, MFA & Passwordless¶

Identity is the new perimeter. In a cloud, remote-work world, who you are matters more than where you are.

The Three Authentication Factor Categories¶

True MFA requires factors from different categories. A password + a security question is not MFA (both are "know").

MFA Methods, Ranked by Strength¶

1. 1.FIDO2 / WebAuthn hardware keys & passkeys — phishing-resistant, the gold standard.
2. 2.Authenticator apps (TOTP) — good; codes rotate every 30s.
3. 3.Push notifications — convenient but vulnerable to "MFA fatigue" (spamming approvals).
4. 4.SMS / email codes — weakest; vulnerable to SIM-swap and interception. Better than nothing.

MFA Fatigue Attacks¶

Attackers with a stolen password spam push prompts until a tired user taps "Approve." Defend with number matching, limited prompts, and user education.

Passwordless & Passkeys¶

Passkeys (built on FIDO2/WebAuthn) replace passwords with a cryptographic key pair tied to your device and biometrics:

• Nothing to phish — there's no shared secret to steal.
• The private key never leaves your device.
• Resistant to credential stuffing and replay.

This is where the industry is heading. Understand it well.

Password Policy — Modern Guidance (NIST)¶

Current best practice has shifted:

• Length over complexity — encourage long passphrases; drop forced symbol rules.
• No periodic forced rotation unless there's evidence of compromise (forced rotation leads to weak, predictable changes).
• Check against breached-password lists — block known-compromised passwords.
• Encourage password managers — unique, random passwords per site.

Single Sign-On (SSO)¶

SSO lets users authenticate once and access many apps. Benefits: fewer passwords, centralized policy and MFA, faster de-provisioning. Risk: the identity provider becomes a high-value target — protect it accordingly. (Protocols in the next lesson.)