MFA factor types in plain terms: the three kinds of authentication factor, how a login checks them, and why phishing-resistant authenticators matter. For anyone who sets up, audits or relies on multi-factor login.
- What it is
Three factor types, one rule
NIST names three types of authentication factor: something you know, something you have and something you are. Multi-factor authentication requires more than one distinct type. Read that way, two passwords are the same type, so they are still one factor. (The sources do not mention two passwords; this is the direct reading of the definition.)
- How it works
Each factor is checked separately
At the assurance level NIST calls AAL2, a login must prove two distinct factors, either with one multi-factor authenticator or with two separate factors. A common pairing is a password (something you know) and a one-time code from an app (something you have). A device unlocked by a fingerprint or PIN can supply two factors in a single step.
- Why it matters
A fake site can relay a code
CISA describes a fake login portal that collects a username, a password and the six-digit code from an authenticator app. NIST notes that an impostor could relay such an output to the real site, and that one-time codes are not phishing-resistant. Properly configured FIDO and WebAuthn authenticators are tied to the domain where they were created, so a falsified web page cannot capture and reuse their output.
Source: CISA, Implementing Phishing-Resistant MFA; NIST SP 800-63B-4, Sec. 3.2.5 and Appendix B
The takeaway: So, factors come in three types. MFA needs two or more different ones. And phishing-resistant methods, like FIDO authenticators, can't be relayed by a fake site. Other second steps, such as text messages or push approvals, have their own weaknesses, and NIST also recognises smart cards and other cryptographic methods as phishing-resistant.
More short lessonsADIR also offers a free external pen test for cloud teams: see the offer.
Transcript
Is your second login step really a second factor? And can a phisher get around it? Authentication factors come in three types: something you know, something you have, and something you are. MFA means using more than one distinct type. So two passwords are still just one factor. At login, the service checks each factor separately. First, your password. That's something you know. Then a second proof, such as a one-time code from an app. That's something you have. Both must pass before you're in. Phishing can still beat that. A fake site collects your password and your one-time code, then relays them to the real site. A FIDO authenticator is tied to the real site's domain, so a fake site can't capture and reuse it. So, factors come in three types. MFA needs two or more different ones. And phishing-resistant methods, like FIDO authenticators, can't be relayed by a fake site.
Narrated with an AI voice.
