• Album@lemmy.ca
    link
    fedilink
    arrow-up
    3
    ·
    11 days ago

    MFA is not necessarily only 2 factors and single factor is not necessarily a password.

    • Syn_Attck@lemmy.today
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      11 days ago

      Sucks that I have to preface but people can be jumpy here. This is genuine curiosity, I’m actually asking, because it’s really probably something I should already know. Can you explain the nuance to me please?


      My understanding, speaking mostly of apps/websites, I know jobs can be much different:

      Most places have the first factor as a password.

      First factor (or “login”) = username+password pair.

      For the longest time that was all there was, “your login” was just a login, which meant a username and password combination. Then 2FA/MFA (“2 factor authentication / multi-factor authentication”) came along in the form of username+password combo plus SMS/email/Google Authenticator/Yubikey/etc to verify as the 2nd form of authentication. You can have 3FA 4FA 5FA whatever if you want and if it’s supported by the app/website. So 2FA is MFA, but MFA is not necessarily 2FA.

      I know jobs can be set up a lot differently.

      • Album@lemmy.ca
        link
        fedilink
        arrow-up
        2
        ·
        edit-2
        11 days ago

        Yeah, that’s basically right. With an opening line like mine (a formula), we’re basically dealing in typical reddit/lemmy pedanticism.

        I (somewhat ironically now) specifically chose the words MFA over 2fa when saying “mfa-1” as to be most encompassing from the get go because yes:

        • the truest definition of MFA is =>2
        • there are cases where the factors are multiple things you have and/or are (like private keys and pass keys, and biometrics)

        i do agree the 1st factor in a situation where its multiple factors is generally and common practice to be something you know.