2FA or MFA – what makes sense and why?

Two factor or multi factor authentication (2FA or MFA)? How to use both better

Passwords - they’re not great on their own. At least, not when you have hundreds or thousands of sensitive documents, credentials or datasets to protect. There’s too much information at stake to guard with just a code and username. As you welcome more collaborators into a digital system, the risk of a hack, breach or leak only increases.

A strong password makes you (somewhat) secure, but doesn’t authenticate whoever’s submitting it. If the password is lost or stolen, someone else can use it — like a robber wearing a bank manager’s suit, waved through to the vault because of what they appear to have, not who they are.

Passwords don’t authenticate identity. Authentication does. And that’s why you’re here. The real question is: What kind of authentication should you go for? 2FA or MFA - What makes sense?

We want to explain what two factor (2FA) and multi factor authentication (MFA) really represent for your digital security. They share some traits but can suit different businesses and contexts. Also, the traditional methods for authentication are changing. But we’ll get to that later.

First, let’s shine a light on what separates these security practices. They make it tougher for criminals to access your user accounts, even if they’ve combed their hair and say all the right things.

The typical split for authentication

Passwords and usernames are the first factor granting user access. The second factor — and others — ask for more “proof” that someone is who they claim to be. Two factor authentication simply layers one more method on top, while multi factor can keep adding layers of protection. Technically, two factor is multi factor, but the latter can continue strengthening security with more prompts and verification tools.

Both methods use at least two of the following ways to approve access:

● Something you know e.g., a regular password, one-time password (OTP), pin number or answer to a security question.
● Something you have e.g., a badge, fob, smart card, software token or smart device.
● Something you are e.g., a fingerprint or voice/facial recognition.

The more authentication layers you have, the tougher it is for cybercriminals to break into an account. 2FA, then, is slightly more complex than a username/password combination, whereas an MFA solution can keep scaling with extra security requirements.

Here’s an example:

Two factor authentication

You have a WordPress plugin that a select number of people are allowed to access. They type their password and username or email address into the login portal. Then, they’re sent an OTP on their mobile device via SMS or an authenticator from the likes of Google or Microsoft. This provides a code that expires in several minutes. Once they enter the code, they’re in.

Multi factor authentication

The WordPress user performs the same first step, but this time, they’re asked to use an authenticator app that unlocks with a face scan from their smartphone camera. After they pass both stages, the app reveals a pin. They type it in. The user has now undergone three security checks. Your system confirms verification based on all of these conditions.

Which authentication do you really need under NIST recommendations?

The U.S. National Institute of Standards and Technology (NIST) develops many of the global standards for information security. It has a bone to pick with any organization that uses single factor authentication i.e., solely passwords. “You should use MFA wherever possible,” says one of their posts on the topic, “especially when it comes to your most sensitive data — like your primary email, your financial accounts and your health records.”

These suggestions reach fever pitch when you’re running a business with dozens or hundreds of people trying to enter an online account. In our WordPress example, a 2FA minimum limits hackers or other malicious actors from unauthorized access in your backend. But the more users and verified devices you’re trying to manage, the wider your attack surface becomes. MFA can grow with the sheer amount of people you’re trying to authenticate.

However, you don’t want to make the MFA journey too arduous. Simple, low-risk accounts that don’t contain much sensitive data can often settle for two factor authentication. If you have a depository of stock photos, for instance, then a username/password and face scan from Google Authenticator works just like an Apple ID for iOS, granting entry in seconds.

On the other hand, you might be protecting medical records, customer names and addresses, top-secret design plans or risk profile information. This is when multi factor authentication comes into play. It’ll take a little longer for users to authenticate themselves, but the extra protection is worth it. You’ll sleep better at night.

In fact, NIST has pushed hard for new MFA standards in the U.S. government throughout 2022. Some of its priorities for critical account protection include:

● Abandoning the use of SMS texts with a pin code.
● Limiting “shared secrets” such as an OTP or unique security answer.
● Promoting asymmetric cryptography in authentication.

Unfortunately, cryptographic authentication also has weaknesses. We’ll examine them soon. But first, we’d like to show you why you don’t have to choose between 2FA and MFA.

Thanks to Almefy, they’re both yours when you need them.