MFA: The Second Lock That Makes a Stolen Password Useless
TL;DR:
MFA asks for one more proof of who you are before it lets you in -- a tap on your phone, a fingerprint, a code that expires in thirty seconds.
Think of it like locking your office with one good key, then leaving it under the mat. Anyone who finds it walks straight in. Add a second lock that only opens for something you carry, and finding the key stops being enough.
On a good day nobody notices it. Three seconds, one tap. On a bad day, somebody two time zones away has your password, types it in, and stops at a door they cannot open. The key under the mat stops mattering.
Beyond the Basics:
Here's the shift: passwords stopped being a secret years ago, and MFA is the control that made that survivable.
Credential dumps are a commodity. Billions of username and password pairs sit in searchable databases, people reuse them across work and personal accounts, and phishing kits harvest fresh ones daily. A password alone tells a system nothing about who is typing it. MFA fixes that by requiring evidence from a second category.
- Something you know. The password itself. Cheap to steal, cheap to reuse, worthless on its own.
- Something you have. Your phone, an authenticator app, a hardware key. The attacker has to hold a physical object, which does not scale from another continent.
- Something you are. A fingerprint or face scan, checked on the device and never transmitted.
Requiring any two categories is what earns the "multi" in multi-factor. Two passwords are not MFA.
The factors are not equal, and the gap matters. SMS codes are the weakest: a SIM swap moves your number to an attacker's phone, and the code follows it. Push approvals hold up better, right until someone spams a user at 2am and they tap Approve to make it stop. That one is common enough to have its own name. App-generated codes and hardware keys sit at the top.
In a Microsoft environment this runs through Entra ID. Conditional Access enforces it by user, app, risk level, or location, and Authenticator number matching kills the blind-approval problem by making the user type a number from the screen.
Here's the catch: MFA is phishable. Attacker-in-the-middle kits proxy the real login page, capture the password and the one-time code together, and replay both inside the valid window. The user sees a normal sign-in. That ceiling is exactly why FIDO2 and passkeys exist. Turn MFA on everywhere first, because it stops the overwhelming majority of attacks for almost nothing, then move your privileged accounts to something that cannot be relayed at all.