If you do only one thing after this course, make it this. MFA is the most effective, easiest protection available to everyone.
What is it?
Multi-factor authentication (MFA) means proving who you are with two or more different factors, not just a password. Even if someone steals your password, they still cannot log in without the second factor.
Select any component in the diagram to read what it does.
Text description of this diagram
MFA asks for a second proof besides your password, so a stolen password alone is not enough.
Why is it important?
Passwords get stolen — through phishing, breaches, and reuse. MFA means a stolen password alone is useless. It blocks the overwhelming majority of account-takeover attacks, which is why banks, workplaces, and major services now offer or require it.
How does it work?
Remember the three factor types from Module 3: something you know, something you have, something you are. MFA combines at least two. After your password (know), you add one of:
- A code from an authenticator app on your phone (something you have).
- A hardware security key you plug in or tap (something you have).
- A fingerprint or face scan (something you are).
An authenticator app or a hardware key is more secure than a code sent by text message, because text messages can sometimes be intercepted or redirected. Any MFA, though, is far better than none.
A real-world example
An attacker phishes someone’s email password and tries to log in. The service asks for the six-digit code from the victim’s authenticator app — which the attacker does not have. The login fails, the victim gets an alert, and the account stays safe. The stolen password was not enough.
Check what you learned
What does multi-factor authentication add beyond a password?
At least one more factor of a different type — something you have or something you are — so a stolen password alone is not enough to log in.
Why is an authenticator app generally safer than an SMS text code?
Text messages can sometimes be intercepted or redirected, whereas a code from an app on your device is harder for an attacker to obtain.
Key takeaways
- MFA requires a second, different proof of identity.
- It makes a stolen password useless on its own.
- Turn it on everywhere it is offered — it is the best easy upgrade.