Multi-Factor Authentication (MFA) and Its Methods
Combining factors to make improper access harder
Multi-factor authentication, or MFA, requires a user to confirm their identity through at least two different factors before granting access, typically a password combined with a temporary code generated by an app, a push notification to a registered device, or a physical security key. Its practical importance is enormous because industry studies show that MFA blocks the vast majority of unauthorized access attempts with stolen credentials, since even if an attacker obtains a user's password leaked in a breach of another service, they won't be able to complete the second factor without physical access to that person's device. An important nuance is that not all MFA methods offer the same level of protection: simple push notifications are vulnerable to fatigue attacks, where the attacker bombards the user with requests until they approve one by mistake, while methods based on number matching or physical keys resist that type of manipulation much better.