The best way to reduce attack vectors and protect your employees and customers is with secure logins. Single-factor authentication, usually accomplished with a password, has proven to be relatively easy to compromise. As such, two-factor authentication (2FA) and multifactor authentication (MFA) have become generally accepted as more secure options.
However, which should you use? Is one more secure than the other? Let’s have a look at both.
Authentication Factor Types
Before learning about the difference between 2FA and MFA, it is important to first understand more about authentication factors. There are four types of account authentication that are used for both 2FA and MFA. Each serves a specific purpose for the protection and security of a user’s account.
Here are examples of the four types:
1. Knowledge (Something You Know)
The most well-known and commonly used authentication factor is knowledge or a piece of information that a user possesses and can easily supply when asked for it before gaining access to their accounts. Some examples of knowledge include:
- Passwords
- Usernames
- PIN
- Email addresses
- Answers to security questions
2. Possession (Something You Have)
“Possession authentication” refers to something that the user would have physically on their person. This could mean a phone, smart card or even a physical key.
3. Inherence (Something You Are)
Something unique to the person accessing the account is known as “inherence” and refers to biometrics, such as the user’s fingerprints, face, eyes or voice. This is considered the most secure form of authentication since it is the hardest to replicate or spoof.
4. Context (Somewhere You Are)
A lesser-used authentication factor, “context” refers to where the user is physically located at the time of their login. The system will use either GPS data or use the IP address to obtain a general location. If the address is unusual, the system can spark an action, such as sending an email to verify that the user is indeed in that location. This is a lesser used authentication factor type, notes All Things Secured.
MFA vs. 2FA
Although it can be easy to think that 2FA is just a version of MFA — after all, “two” can be considered “multi”—2FA has a strict set of guidelines that sets it apart from other forms of authentication.
2FA tends to rely solely on an SMS code or biometrics as the second form of verification. Users do this by first entering their single-factor authentication — usually a password — then the system brings them to the second authentication verification. Then after that, the user is done and either authenticated or not, and no more steps are involved.
MFA implies an additional form of authentication. This can include biometrics readings (along with all of the other security features included with typical 2FA) and up to four forms of verification, delivering the strongest security for an account. It also makes it highly unlikely for a hacker to be able to access an account since there are four stopgaps along the way, cites Security magazine.
As such, MFA is generally considered more secure than 2FA, but 2FA can work just as well and might be more appropriate for apps that do not store sensitive data, such as social networking apps.
It’s important to note that the storage of recovery keys can itself be a vulnerability, especially if they are stored in the cloud. Several solutions exist to protect against loss, such as storing them offline in a secure, physical location.
Rethinking Authentication Factors
As counterintuitive as this might sound, some authentication factors do not always bring about the ironclad, phishing-proof security they aim to.
Earlier this year, as reported in Slate.com, Google released research about its 2FA system that suggested that its use of 2FA — now reaching more than 150 million people — surprisingly reduced account compromises by only 50 percent. In its 2019 study of user accounts that had two-step verification enabled, Google found that SMS-based multifactor authentication successfully blocked 100% of automated bots, 96% of bulk phishing attacks and 76% of targeted attacks.
In other words, 2FA may not be working as strongly as it should be. This could be because hackers are getting better at leveraging techniques that circumvent MFA. For instance, many are now capable of intercepting verification codes through stolen text messages or cookies from users’ browsers after they have already completed their verification, successfully tricking websites into believing that they’ve already authenticated and thereby bypassing the MFA protections altogether.
This does not mean that all authentication procedures should be eliminated. Instead, organizations need to be selective in which factors they present to employees and customers. If 2FA and MFA are providing too much frustration and friction, the organization will need to re-think the authentication factors and devise a mix that works optimally with the least pushback from employees, partners and customers while still maintaining the strongest security possible.
Which Authentication Policy Is Right for Your Organization?
The Migus Group can assist you with implementing or improving your enterprise’s authentication and identity systems, helping you reduce the friction in securing your employees and customers. Contact us today to learn more.
Jake Wengroff writes about technology and financial services. A former technology reporter for CBS Radio, he covers such topics as security, mobility, e-commerce and the Internet of Things.