Understand the Second Factor

The concept

Multifactor authentication combines distinct kinds of evidence, such as a secret you know and an authenticator you possess. Two passwords are still the same type of factor. Security depends on the method and recovery path; some approaches resist fake websites better than codes that a person can be tricked into handing over.

Worked example

A fictional neighborhood association secures its shared administration account. An attacker obtains the password through an unrelated breach but cannot supply the registered authenticator. The second factor blocks that attempt. The association records who is authorized to administer the service, keeps recovery material securely, and checks that a second responsible person can regain access if the first administrator loses a device.

Limits and judgment

Multifactor authentication is not a license to approve unexpected prompts. An attacker may repeatedly request approval or imitate support staff asking for a code. Never treat a push notification as proof that the request is legitimate. Review available phishing-resistant options and recovery procedures for important accounts. Usability, accessibility, and provider support affect which method can be operated reliably.

RETRIEVE. REASON. REMEMBER.

Knowledge check.

Choose one answer for each question, then check your reasoning.