An accountant enters her password and a six-digit code on what looks like her company's sign-in page. Within seconds an attacker overseas is signed in to her mailbox with the same password and the same code, relayed through a proxy before the code expired. She used multifactor authentication exactly as trained, and it still failed, because MFA methods are not equally strong.
On the CompTIA Security+ SY0-801 exam, MFA methods fall under objective 4.5, which lists hard tokens, soft tokens, biometrics, one-time passwords and backup codes, and asks you to apply them in scenarios. This lesson explains how each method works, how each one fails, and how to choose between them, ending with what makes a method phishing-resistant.
MFA requires factors from different categories, not just more steps
Authentication factors fall into categories: something you know, such as a password or PIN; something you have, such as a security key or a phone; and something you are, such as a fingerprint. Some references add somewhere you are and something you do, such as the country a sign-in comes from or a typing pattern. In practice those work best as signals that raise or lower risk, not as a factor that stands on its own.
Multifactor authentication requires at least two different categories. A password followed by a security question is two steps but one factor, because both are things you know. A password followed by a code from a hardware token is two factors. A fingerprint that unlocks a private key stored on a phone is also two, because the key is something you have and the fingerprint is something you are.
Many organizations apply MFA adaptively. A sign-in from a managed laptop on the office network may need only one prompt, while the same account signing in from a new country triggers a stronger method or a block. Whatever the policy, the methods below are what the user actually holds.
Hard tokens are dedicated devices: security keys, smart cards and OTP fobs
A hard token is a physical device whose only job is authentication. Three kinds appear in practice.
FIDO2 security keys plug into USB or tap over NFC. During registration the key creates a new key pair for each site; the private key never leaves the device. At sign-in the user touches the key to prove presence, often enters a PIN, and the key signs a challenge from the site. Nothing is typed, and there is no shared secret on the server to steal.
Smart cards hold a certificate and private key and are unlocked with a PIN. US federal civilian agencies issue PIV cards and the Department of Defense issues CACs, used for Windows logon, VPN access and email signing.
OTP fobs display a code that changes on a timer, commonly every 30 or 60 seconds, or on a button press. They need no network connection of their own, which makes them useful where phones aren't allowed or have no signal.
Hard tokens resist malware on the user's phone or laptop, because the secret lives on separate hardware. Their costs are logistics: buying and shipping devices, replacing lost ones and supporting card readers. Users who rely on a security key should register two, keeping the spare somewhere safe.
Soft tokens live in software on a device the user already carries
A soft token is an authenticator that runs as software, usually on a phone. The common forms are authenticator apps that generate one-time codes, push notifications the user approves, and certificates or keys stored in the device's software or secure hardware.
Soft tokens are cheap and fast to deploy because nearly everyone already carries a phone. Their weaknesses come from that same phone. Malware on the device can read codes or approve prompts, a lost phone takes the token with it, and an authenticator seed can be copied. When a user enrolls an authenticator app, the QR code they scan contains the shared secret in plain text:
otpauth://totp/ExamCorp:mlopez?secret=JBSWY3DPEHPK3PXP&issuer=ExamCorp&digits=6&period=30
Anyone who photographs or screenshots that QR code during enrollment can generate the same codes as the user until the token is re-enrolled with a new secret.
Push notifications add their own risk. Attackers who already have a password can trigger prompts repeatedly, hoping the user taps Approve to make them stop. Number matching, where the user must type the number shown on the sign-in screen into the app, defeats blind approval, and showing the location and app in the prompt helps users spot fraud. MFA fatigue and other bypass techniques are covered in the credential attacks section.