Multi-Factor Authentication: Beyond the Basics
Not All MFA Methods Are Created Equal
Multi-factor authentication significantly improves security over passwords alone, but the level of protection varies dramatically depending on which factors you use and how they are implemented.
SMS-based verification codes are better than nothing, but they are vulnerable to SIM swapping attacks and interception. We have seen attackers successfully intercept SMS codes by either socially engineering mobile carriers or exploiting vulnerabilities in the SS7 protocol that underpins mobile networks.
Authentication apps that generate time-based one-time passwords offer better security. The secret key never leaves your device, and the codes cannot be intercepted in transit. However, they are still vulnerable to phishing attacks where users are tricked into entering codes on fake websites.
Hardware Security Keys: The Gold Standard
Hardware security keys represent the most secure form of MFA available today. These physical devices plug into your computer or connect via NFC to your phone. They use cryptographic protocols that are resistant to phishing attacks.
When you use a hardware key with protocols like FIDO2 or WebAuthn, the authentication process is bound to the specific domain you are accessing. Even if an attacker creates a perfect replica of your login page, the hardware key will not respond because the domain does not match.
The main challenges with hardware keys are cost and logistics. You need to purchase keys for all users, have a process for distributing them, and handle the inevitable lost or damaged keys. Despite these challenges, for high-risk accounts like administrators, hardware keys are worth the investment.
Conditional Access and Risk-Based Authentication
Modern authentication systems go beyond simple "do you have a second factor" checks. They evaluate the risk of each authentication attempt based on multiple signals and adjust requirements accordingly.
A login from a recognized device on your corporate network might not require MFA. The same user logging in from a new device in a foreign country should face stricter requirements. This balance between security and usability helps ensure MFA does not become so burdensome that users find workarounds.
The Backup Authentication Problem
What happens when a user loses their second factor? You need a backup authentication method, but every backup method creates potential security weaknesses that attackers will target.
The classic approach is backup codes - one-time use codes generated during MFA setup that users should store securely. In practice, users often store these codes insecurely, lose them, or never save them in the first place.
Some organizations use administrator override capabilities, where a help desk technician can temporarily disable MFA for a user. This creates a significant security risk if the help desk process is vulnerable to social engineering.
Consider implementing a waiting period for backup authentication. If someone claims to have lost their MFA device, require them to verify their identity through multiple channels and wait 24-48 hours before resetting. This delay prevents attackers from immediately exploiting compromised accounts.
Preventing MFA Fatigue Attacks
MFA fatigue attacks exploit push notification systems. An attacker with stolen credentials repeatedly triggers push notifications to the victim until they approve one, either by accident or just to make the notifications stop.
These attacks have successfully compromised numerous organizations. The solution is straightforward but requires specific features from your MFA system: implement number matching or context-aware approvals.
Number matching requires users to type a number shown on their screen into the authenticator app. Context-aware approvals show users what application or resource is being accessed. Both approaches ensure users think about what they are approving rather than reflexively tapping "approve" on their phone.