La Multi-factor authentication has become a basic requirement of any modern cybersecurity strategy. A halfway decent password is no longer enough: with the volume of data breaches, increasingly sophisticated phishing, and automated attacks, relying solely on "what you know" is almost like leaving your front door ajar.
In recent years there have appeared New authentication methods, guidelines from organizations such as PCI SSC and standards like FIDO2 or WebAuthn that have completely changed the landscape. The result is that today there are many different ways to verify a user's identity, with very different levels of security and convenience. The issue is no longer just enabling MFA, but choose the right combination of factors to use depending on the risk, the context, and the type of service.
Fundamentals of identification, authentication, and authorization
Before comparing methods, it is worth remembering that Authenticating is not the same as identifying oneself or authorizing oneself.although in practice everything is part of the same access flow.
First, the Identification is simply assigning a unique identity. to a person, system, or account: a username, an employee number, a certificate, etc. It's the "who are you?" without yet verifying that you really are that person, system, or account.
La Authentication is the process of verifying that that identity is valid.To do this, the system asks you to provide one or more authentication factors that only you should know, possess, or be. If this check is successful, the system validates your identity.
Por último, la Authorization defines what that user can actually access Once authenticated: what applications he/she sees, what data he/she can access, whether he/she can manage other users, etc. This can be complemented with tools that allow you to know who has access to your files and thus audit permissions and sharing.
The coherent management of these three elements forms what is known as Identity and Access Management (IAM)And in frameworks like PCI DSS, it is thoroughly reviewed in terms of specific access control requirements. In Windows environments, this is usually managed with the Group Policy Editor.
Authentication factors: something you know, have, or are
Every modern authentication system revolves around three major families of factorswhich can be combined to build double or multifactor schemes:
On one side is “something you know”Passwords, PINs, passphrases, or security questions. Their main advantage is that they are easy to deploy and very familiar to any user, but they are also the preferred target of attackers, whether through brute force, phishing, database leaks, or credential stuffing.
Second we find “something you have”This could be a mobile phone to which an SMS is sent, an authentication app, a smart card, a physical token, or a FIDO key. In this case, the attacker would need to steal or clone that element to bypass the filter, which theoretically significantly increases security.
The third category is “something you are”That is, biometric factors such as fingerprints, facial recognition, iris scans, or even behavioral characteristics (typing style, gait, voice patterns). They are very convenient and difficult to replicate, but they pose serious privacy and management challenges: you can't easily "change your fingerprint" if it's compromised.
Furthermore, contextual or behavioral factors are becoming increasingly important, sometimes grouped as “something you do” or “something that happens around you”Location, device you connect from, usual time of day, known IP address, etc. On their own, these are not usually considered "strong" factors, but they are the basis of risk-based adaptive authentication.
Passwords, PINs, and knowledge-based authentication
The call Knowledge-based authentication (KBA) It's the traditional model: you enter a username and password, or answer a question like "What city were you born in?". It's extremely cheap to implement, supported by any platform, and users already know how it works.
The problem is that, in practice, Passwords are reused on a massive scale between services and are often weak. Various studies indicate that a huge percentage of people use the same password on dozens of sites, so if just one website has a vulnerability, the rest of the accounts are at risk through credential stuffing attacks.
Traditional security questions are even worse.Many answers can be found by searching a little on social media or in public sources, and others are relatively easy to guess. Therefore, it is now recommended to limit them to very specific cases or replace them with other retrieval mechanisms.
The PINs are an interesting special caseOn paper, a 4-digit PIN has very little entropy and wouldn't meet the complexity requirements we typically demand of passwords. However, recent PCI SSC guidelines clarify that a PIN can be accepted as a "something you know" factor as long as it's combined with additional controls such as lockouts after multiple failed attempts, progressive timeouts, and secure storage.
When it is not possible secure that PIN with anti-brute-force measuresTherefore, it must meet the same criteria as a strong password: a sufficiently high minimum length, prohibition of trivial patterns, history, etc. Otherwise, it becomes an easily exploitable weakness.
One-time codes: SMS, email, and pre-generated lists
One of the most widespread methods of MFA continues to be the use of one-time codes (OTP) sent through different channels or printed beforehand. This is a second factor that is very simple for the user to understand and that many services offer by default.
In the case of OTP via SMS or voice callThe process is straightforward: after entering your username and password, the system sends a multi-digit code to the registered number. The user enters the code, and if it matches, access is granted. Essentially, it verifies that you still have control over that phone number.
We can also find OTPs sent by emailThis is less common but still present. The risk here is obvious: if your email password is the same as the password for the account you're trying to protect, the added security vanishes because the attacker can access your inbox first and easily read the code.
A more classic approach is that of the pre-generated code listsThese codes are provided by some banks in print or can be downloaded by certain services (such as large online platforms) for account recovery. Each code is used only once, and subsequent attempts must use a different code from the list.
These lists are quite secure against interception attacks because They are generated and delivered at very specific times.The critical point is storage: if you keep the sheet in an unlocked drawer or take a photo and leave it in the gallery unencrypted, anyone with physical access to your things could hijack your accounts or funds.
To manage these lists well, it is advisable to store them in a secure physical location or in an encrypted digital containersuch as the secure notes in a password manager. However, they have a clear scalability problem: if you perform many transactions or have many accounts, they quickly run out and become difficult to manage, so they are increasingly used less as a primary method and more as an emergency mechanism.
Authentication and TOTP applications
The latest guidelines and practical experience agree that Time-based authentication applications (TOTP) They offer a very good balance between safety and comfort, which is why they are recommended as the "default" option whenever possible.
The principle is simple: during the discharge of the second factor, The service and your authentication app share a secret key (usually by scanning a QR code). From there, both the app and the server generate the same 6 or 8 digit code every 30 seconds without needing a connection, thanks to a standard algorithm.
Tools like Google Authenticator, Microsoft Authenticator, Authy, Aegis or Duo Mobile They allow you to register multiple accounts and keep all your codes centralized. Some include encrypted cloud backups or synchronization across devices, which is very practical but should be configured carefully to avoid introducing new risks.
There are also Password managers that integrate TOTP (1Password, Bitwarden, Dashlane, and others). In these cases, the same product stores the password and generates the temporary code, making login extremely convenient. However, from a purely security standpoint, you lose some independence between factors, as both rely on a single point of failure.
In any case, compared to SMS or email, TOTPs have clear advantages: They do not depend on the mobile network or the operator.They are less susceptible to SIM swapping attacks, work without coverage, and do not expose code on easily interceptable channels.
Biometrics: fingerprint, face, voice, and other features
La Biometric authentication is no longer science fiction to become part of everyday life: almost any current smartphone allows you to unlock it with a fingerprint or face, and many laptops integrate fingerprint readers or cameras compatible with secure facial recognition.
Biometrics relies on physical or behavioral characteristics that are difficult to replicateFingerprints, facial features, iris, voice, typing dynamics, gait, etc. From the user's point of view, it is extremely convenient because it avoids having to remember anything and reduces friction in access.
However, there are important nuances. The first is that Biometric data is inherently sensitiveYou can't "revoke" your face or fingerprints if they're compromised, and they serve not only for authentication but also for legal identification. This means that their capture, storage, and processing must be done with a very high level of protection.
For this reason, most modern architectures limit biometrics to local authentication processes on the device itselfFor example, when you use Face ID or a fingerprint reader, the data is stored and processed in a secure enclave on the phone and is not sent to the remote service. What is transmitted is a "yes" or "no" from the operating system indicating that the legitimate user has unlocked the device.
In the case of pure remote biometric authentication, the service that receives that data It has to implicitly trust the device manufacturer or the system providerThis is something few organizations are willing to do except in very closed ecosystems. A prime example is Apple, which has end-to-end control over hardware and software and offers mechanisms like Face ID integrated with access keys.
Although it has drawbacks, biometrics offers A key advantage: it drastically reduces frictionA user who unlocks their mobile phone with their finger or face hundreds of times a day is much more willing to accept MFA if that is the additional "inconvenience" they have to assume, instead of typing kilometer-long passwords every time they access it.
Location, context, and risk-based authentication (RBA)
Beyond the classic factors, many modern systems apply risk-based authentication (RBA)dynamically adjusting the requirements based on what they observe in real time.
Essentially, the system analyzes contextual variables such as location, device, IP address, time of day, or usage patternIf someone tries to log in from their usual laptop, at their usual time, and from the office network, the risk is considered low, and they may not be asked for anything extra beyond their password or SSO session.
However, if a Logging in from another country, at an unusual time, or from an unrecognized deviceThe risk engine can raise the level of requirement and require a second additional factor, such as an OTP, an app approval, or a biometric check.
This approach has the great advantage of balancing security and usabilityIt doesn't penalize the user with unnecessary steps when everything seems to be in order, but it raises its guard when something seems off. For banks, large online platforms, or companies with thousands of employees, it's practically a standard.
Its main drawback is that It is not trivial to design or adjustIf risk thresholds are incorrectly calibrated, you could end up constantly requesting MFA from legitimate users or, at the opposite extreme, overlooking suspicious behavior. Here, advanced analytics and, increasingly, artificial intelligence play a key role in detecting anomalies and unusual patterns.
Multi-factor authentication: multi-factor vs multi-step
When we combine two or more different factors, we are talking about multi-factor authentication (MFA)The idea is that, even if an attacker manages to break one of the factors (for example, the password), they will still have to overcome a second independent filter (such as an OTP or a physical key).
From a compliance perspective, frameworks like PCI DSS connect the concept of MFA with very specific requirements: remote access to internal networks, access to card data environments, accounts with elevated privilegesetc. In these cases, relying solely on username and password is no longer acceptable.
For years there was quite a bit of confusion about the difference between Multi-step authentication and PCI-compliant MFAOlder guidelines required that all factors be evaluated without the user receiving partial feedback, that is, that they not be told if the password was correct before asking for the second factor.
The most recent versions of the guide clarify the criteria: It is acceptable to indicate the success of one factor before requesting the next.provided that access is not granted until everyone has been successfully verified. This means that flows like "password first, then OTP" are compliant, even if the user is confirmed that their password is valid.
Even so, it remains as good practice to reduce that granular feedback: either not revealing the validity of any factor until all have been presented, or authenticating first with a one-time session factor (OTP, phishing-resistant key) before validating other static factors such as the password.
FIDO U2F / FIDO2 hardware keys and passkeys
Faced with the problems of phishing and "man-in-the-middle" attacks from many traditional methods, solutions such as the following have emerged: FIDO U2F/FIDO2 security keyspopularized by devices such as YubiKey, Google Titan, or models from Feitian and SoloKeys.
These keys implement public-key cryptography and, during registration, They generate a unique key associated with each serviceWhen you re-authenticate, the server sends a challenge that the key only signs if the domain and context match those registered. If someone tries to trick you with a fake website, the key detects that it's not the legitimate site and doesn't sign anything. Many platforms use this. TPM 2.0 to protect the keys associated with the device.
Thus, this type of authentication not only verifies the user, but also It also verifies the service itself.They offer very high resistance against phishing, replay, and relay attacks. That's why many organizations consider them the gold standard for protecting critical accounts, administrative credentials, and corporate email access.
From the user's point of view, the process is surprisingly simple: Connect the key to the USB port or bring it close via NFC. Simply tap the capacitive sensor on your phone and you're done. There's complex cryptography behind it, but the gesture is easier than typing an OTP.
On this same basis, the FIDO Alliance has promoted the access keys or passkeysThese take the idea a step further by directly replacing passwords. The private key is stored on the device (or is encrypted and synchronized via the provider's cloud), and the user authenticates by unlocking that device with biometrics or a PIN.
Passkeys remain multi-factor by design, as they combine something you have (the device) combined with something you are or know (biometrics or PIN)But they eliminate the traditional password from the equation. More and more major services are starting to offer them, although the ecosystem remains somewhat fragmented and each platform implements different nuances.
SSO, token-based authentication, and digital certificates
In corporate environments, it is common to combine these factors with mechanisms such as Single Sign On (SSO)which allows you to log in once against a trusted identity provider (e.g., Azure AD, Okta, Google Workspace) and access multiple applications without continuously repeating credentials.
In these schemes, the identity provider issues security tokens (such as JWT) After strong initial authentication (ideally with MFA), these tokens are presented to integrated applications to prove your identity without needing to re-enter your password at each hop.
Token-based authentication reduces the load on servers and facilitates stateless architectures Widely used in modern APIs and applications. However, the management of token expiration, renewal, and revocation must be very well designed to prevent a stolen token from becoming an unlimited pass.
Another very robust method, especially for internal networks and VPN access, is the authentication based on digital certificatesInstead of a password, the user presents a certificate issued by a corporate certification authority, and the server cryptographically verifies its validity.
This approach is extremely robust against many common attacks, but it involves maintain a well-governed public key infrastructure (PKI)Issuance, renewal, revocation, usage policies, device management, etc. That's why it's usually reserved for high-security environments where the effort is worthwhile.
Session Management and Zero Trust
Once the initial authentication process is completed, almost all systems establish a session that represents the relationship of trust between the user and the service. Instead of requesting MFA on every click—something impractical—that session is reused to authorize subsequent requests.
This causes many attackers to focus on steal or hijack active sessions through cookies, tokens, or similar mechanisms, instead of trying to bypass multi-factor authentication directly. That's why it's so important to complement MFA with good session management practices.
Among the usual recommendations we find link sessions to specific users and devices to prevent reuse from different devices, apply reasonable idle timeouts, force MFA re-authentication in especially sensitive operations, and always use encrypted channels such as TLS.
All these elements fit very well with the approach of Zero Trust Architecture (ZTA)where implicit trust is not assumed simply for being "inside" the corporate network. Each relevant request is evaluated based on context, device status, and identity, reducing the impact of a potentially compromised session.
Practical comparison of MFA methods and recommendations
With all of the above on the table, it is reasonable to ask Which multi-factor authentication methods are best? and how to choose the right combination for each use case without driving the user crazy.
If we order the factors from weakest to most robust, we can place at the bottom SMS, email, and security questionsThey meet the formal requirement of "something you have/know", but are highly vulnerable to SIM swapping, forwarding, phishing and password reuse.
At an intermediate level are the TOTP applications, simple physical tokens, and certain biometric methods They are well implemented, offer a good balance between security and usability, and are the standard recommendation for protecting most personal accounts and many corporate accounts.
Above we find the FIDO U2F/FIDO2 keys and phishing-resistant passkeysThese methods combine robust cryptography, domain binding, and device-associated authentication. For high-value accounts—finance, systems administration, critical dashboard access—they are the preferred method.
From this point on, the choice of a specific business should consider what type of data does it protect, what level of friction can its users tolerate, and what budget does it have? to deploy and maintain the infrastructure. Most organizations end up combining several approaches: strong MFA for sensitive access, SSO for day-to-day convenience, and RBA to balance security and user experience.
In any scenario, there are clear points of consensus: Enable MFA whenever possible, and prioritize phishing-resistant methods When the risk justifies it, protect the recovery of accounts very well, for example. Regain access to Windowsand train users to understand why they are asked for that "second step" and how to detect fraud attempts.
In an environment where identity theft accounts for a large proportion of incidents, strengthening authentication with the appropriate methods allows drastically reduce the chances of account compromise without sacrificing a reasonable user experience, and has become a basic requirement for both individual users and any organization that wants to take security even minimally seriously.
