User Access Restriction
Multi-Factor Authentication
Multi-factor authentication (MFA) is an access restriction that asks you to prove who you are in more than one way before a system lets you in. Each way is called a factor, and the factors must come from different types — typing two different passwords is not multi-factor, because both are the same type.
The three factor types
| Factor type | What the user supplies | Strength against an attacker |
|---|---|---|
| Something you know | Information you remember, such as a memorised phrase | It can be guessed or tricked out of you, so on its own it is weak |
| Something you have | A physical object you possess, such as a device registered to your account | The attacker must get hold of the object itself, not just some information |
| Something you are | A biometric measurement of your body or the way you behave | It is part of you, so it cannot be handed over — but stored biometric data can still be stolen |
Why more than one factor is safer
A single method fails the moment that one secret leaks. Requiring a second, different factor means an attacker who learns your memorised phrase still cannot get in, because they do not also hold your registered object.
For example, the volunteer coordinator at a city farm opens the rota system by typing a phrase she has memorised, then approves a prompt on the smart watch registered to her account. Someone who sees her type the phrase still cannot log in without her watch. With only the phrase, that person would have been straight in.
Drawbacks
- It is slower: every login takes two steps instead of one, which staff may find inconvenient on a busy day.
- A factor can be lost or left behind, such as a registered device, which locks out the genuine user until it is replaced.
- Issuing and managing the extra factors takes time and money.
Practise this
Pearson BTEC Digital Information Technology · User access restriction