Multi-Factor Authentication (MFA) - Simply Explained

0:00 Nearly nine in ten attacks on the web start with a stolen password. That's one secret you type into every site you use, so one leak spreads everywhere. MFA asks for a second different kind of proof, and that's where most of us pick the weaker option. By the end, you'll know which second step to pick and the mistakes that undo the whole thing. Welcome to the M365 FM podcast, where we explore the people, ideas, and technologies shaping the future of work. Why a password on its own isn't enough? A password answers one question, and that question is whether you're really the person you say you are. It's a single secret. And since you reuse that same secret everywhere, it only has to leak once to stop being secret at all. Picture how much of this is already out there. In twenty twenty four, criminals posted roughly two point eight billion passwords for sale or handed them out for free.

0:43 And among the ones researchers examined, only about three in every one hundred made even basic complexity rules. The break ins that target ordinary websites lean on stolen credentials rather than a clever exploit, and around six in ten breaches involve a person who clicked the link, replied to a message, or got talked into something. In other words, the weakest point is usually the human being who's being asked to trust something. Adding an exclamation mark to the end of your password doesn't change any of that. Length and symbols make a password harder to guess, and guessing stopped being the main attack. Years ago. Somebody else already has your password and they're not guessing because they don't have to. A password manager helps, and it's worth saying out loud because it's the one habit that makes everything else easier. It gives every site its own long random password, so a leak at one website doesn't hand over the keys to all the others.

1:29 What it can't fix is the deeper problem, because a password is still one kind of proof, and it still lives in your head or in a vault, which means it can still be stolen. Microsoft's own research puts MFA at blocking more than ninety nine point nine percent of account compromise attacks. That number comes from a study of automated attacks, so treat it as strong evidence rather than a promise about every human being sitting at a keyboard on the other end. Now the head fake. You might assume the problem is that your password isn't long enough, but the real problem is that a password is one answer, and one answer only has to be stolen once MFA fixes that by demanding a second, different kind of answer. And it's the word different that carries all the weight. Which brings us to the term everybody uses, and almost nobody explains.

2:09 And that term is factor. It's worth pinning down properly because the choice you're about to make comes down to it. The three things a factor can be a factor is one piece of evidence that your you. And the useful part is that factors come in only three kinds. Something you know, which covers a password, a PIN, or. The answer to a security question. Something you have which covers your phone and authentication app on it, or a physical key on your keyring and something you are, which covers a fingerprint, a face scan, or another part of your own body. The rule that trips people up is that two items from the same bucket still count as one factor. If your password is sunshine and your backup question is your mother's maiden name, you haven't added security because you've added a second thing an attacker can find on your social media in about four minutes.

2:50 Two passwords is still one category of proof, so the login stays exactly as fragile as it was before you added the second one. That sounds obvious once you say it out loud, and it's the most common way people think they've turned on MFA when they really haven't. Security questions are the usual version of that mistake. A question like what was your first car? Feels personal and personal, feels safe, but the answer is usually public somewhere, which makes it closer to a hint than a lock. The something you are bucket is the one people like best, because your face and your fingerprint can't be forgotten and can't be written on a sticky note. The catch is availability. Not every device has a fingerprint reader you trust, and not every service supports a face scan for sign in, so it's a great option when it's offered and a dead end when it isn't. One detail surprises people here.

3:31 A text message counts as something you have, even though it feels flimsy. Because the code is delivered to a device you're holding, the category is right. The delivery method is what's weak, and that's a separate question from which bucket it belongs to. So in practice, most real world MFA ends up pairing something you know, with something. You have your password plus one other thing that lives somewhere an attacker can't simply read. Everything interesting now happens in the choice of that second thing. So let's watch what the technology actually does. When you sign in. What actually happens when you sign in? Here's the ordinary version, the one you've done a thousand times. You type your password, the service checks it, and then instead of letting you in, it asks for one more thing. That extra step is the entire mechanism. The second thing is usually a code, and the code is the part people misunderstand.

4:13 A one time code is a secret with a very short shelf life, generated fresh for that single sign in. Even if an attacker watches it appear, it's worthless a minute later. Now think about what the service is really asking for. It wants proof that comes from somewhere the attacker isn't, and that's a much harder requirement to fake. If you know the password and you still have the phone, then an attacker has to steal two unrelated things instead of one, and that changes the economics of the whole attack. There's another version of the same idea, and it's the one people find hardest to picture. With a security key or a passkey, your device holds a private key that never leaves it. When you sign in, the site sends a one time challenge, your device signs that challenge, and the site checks the signature. Nothing reusable ever gets typed into a page, so there's nothing to steal at the keyboard and nothing to overhear in a phone call.

4:55 That's a lot of machinery sitting behind one tap, and it explains why some second steps feel almost effortless, while others feel like a chore. The effort in this case is the security, something worth knowing before we compare the options. When a site offers to keep you signed in, that usually doesn't remove the MFA requirement, it just delays the next prompt on a shared or borrowed computer. Always take the option that signs you out when you're finished, because a session left open is a session somebody else can walk into. With that, the theory is done. What's left is the comparison that decides how safe you actually are. Because the three options people choose between are nowhere near equal authenticator apps, text messages, and security keys. Now for the comparison, which is the part worth actually remembering, almost everyone ends up choosing between three second steps, and they're not equal in any way that matters.

5:38 The first option is the one nearly everybody already uses, which is a text message or an automated phone call. You sign in, a code lands on your phone, and you type it in. It's easy. It works on any phone and there's nothing to install. That convenience is real, and so is the weakness. A text message travels over the phone network, and the phone network can be hijacked. Someone can convince your carrier to move your number onto a SIM card they control, and then your codes start arriving on their phone instead. Google's own security research from twenty nineteen put numbers on how much that matters. Text based codes stopped about ninety six percent of bulk phishing attempts, but only seventy six percent of targeted ones, which means they're decent against a broad spray and much shakier against someone who has picked you specifically.

6:19 Verizon's breach report now recommends against text codes for sign in. Altogether. The middle option is an authenticator app, and it comes in two flavors you've probably seen. One hands you a rotating code that you type in, which works fine and doesn't touch the phone network at all. The other sends a notification and asks you to approve, which is faster and done carelessly weaker. That weakness has a name and a fix. If all an attacker has to do is flood you with approval prompts until you cave, that's a real attack, and it works more often than it should. The fix is called number matching. Instead of a simple approve button, the sign in screen shows you a number, and you have to type that number into the app to continue. Now you can't approve a login. You didn't start without reading a number off a screen. You're not even looking at Microsoft turns number matching on by default in its authenticator app and doesn't let users switch it off.

7:03 Prompts still be text messages by a wide margin. Google's research on prompt based sign ins found they blocked roughly ninety nine percent of bulk phishing and ninety percent of targeted attacks, which is a clear step up from a code sent over the phone network. Then there's the strongest option, which is a security key or a pass key. A security key is a small piece of hardware you tap or plug in. A pass key is the same idea built into your phone, your laptop, or your password manager. Either way, the credential stays tied to that device, and Cisa describes it as the only widely available method that's genuinely resistant to phishing. It's also faster. Microsoft's own figures put passkey sign ins at around three times quicker than typing a password, and eight times quicker than a password, plus a standard MFA prompt.

7:43 They also succeed about ninety eight percent of the time, compared with thirty two percent for passwords. Here's the rule that makes the whole comparison simple any MFA beats no MFA and phishing resistant beats everything else. That last phrase, phishing resistant, shows up in every serious guide and almost never gets explained. So it's worth getting straight because it's where the real difference between these options lives. Why phishing resistant is the phrase that matters. Phishing used to be easy to spot. Bad grammar, a strange sender, and an urgent demand for your password were the giveaways. That version still exists, but the version that beats MFA is a different animal because it's a near-perfect copy of the real login page. The trick is that the fake page sits between you and the real service.

8:23 You type your password into the copy. The copy passes it along to the real site. The real site asks for your code. You type the code into the copy and the copy passes that through to. Everything looks normal from where you're sitting and the attacker ends up inside your session. Security people call that an adversary in the middle attack, and it's the reason a code you type in can't save you against a well-built fake page. The code was correct. It just went to the wrong place. Push fatigue is the even simpler version, and it doesn't need a fake page at all. The attacker already has your password. They keep trying to sign in and every attempt fires a notification at your phone. The bet is that eventually you'll tap approve just to make the noise stop. This has happened to real companies and one story makes it concrete. In September twenty twenty two, a hacking group got hold of an external contractor's credentials for Uber's systems.

9:07 They started hammering his phone with approval prompts, and when he didn't bite, they found him on WhatsApp and talked him through it, convincing him the flood of prompts was a glitch he should clear. He approved one and the group was inside. The password held up fine. The second step was the failure because it was a tap that a human being could be talked into. Making. Verizon's twenty twenty five breach report looked specifically at attacks against Microsoft three hundred sixty five accounts and sorted the bypasses by method. Token theft accounted for thirty one percent, prompt bombing for twenty two percent, and adversary in the middle attacks for nine percent. Those three cover most of what actually defeats MFA out in the world. A security key or a pass key survives all of it for one reason, which is that there's no reusable secret at any point in the exchange.

9:47 The key won't produce a signature for a fake site, so a copied page gets nothing. It can relay. There's no code to read out loud to a convincing stranger, and there's no lazy approved button to press until somebody gives in. The attack has to change shape entirely. One honest caveat before we move on. MFA is a speed bump, not a wall. And Google's numbers for targeted attacks, seventy six percent for text codes and ninety percent for prompts mean that roughly one time in ten, a determined attacker still gets through. What MFA buys you is time and cost. It makes you a harder target than the person next to you, and that's often the entire game. Which raises the practical question of how you turn any of this on without making everyone's week worse. Rolling it out without a mutiny. If you're setting this up just for yourself, this part is short.

10:28 Turn it on. Pick the strongest method your accounts support and get on with your day. If you're doing it for a team, the order matters more than the tool. Start with a small group of people who are willing to be the test case, and let them break it before everybody else has to meet it. Then widen the circle and roll your riskiest accounts first. Which means anyone who can reset other people's passwords, anyone with finance access, and anyone who touches the systems everything else depends on. Microsoft now requires MFA for the portals that administer Azure and Microsoft three. Sixty five so in a lot of tenants, that decision has already been made for you. Give people at least two ways to prove who they are, and then give them a route back. And when both of those fail, a second factor that can't be replaced is a security control that turns into a permanent lockout.

11:08 That day, someone drops their phone in a lake. Set up recovery codes in an emergency account before you need them, and store them somewhere you'd actually be able to reach at two in the morning. Nobody enjoys this part, and it's what keeps the rollout from falling apart. Expect friction and plan for it instead of being surprised by it. Google's research found that in one experiment, thirty eight percent of users didn't have their phone with them when they were challenged, and another thirty four percent couldn't remember their backup email address. Those numbers are exactly why you enroll a second method and build a recovery path that actually works. The last piece is communication, and it's the piece most teams leave out. Say why in one sentence and keep it about the attacker rather than the employee. The point is that a stolen password stops being enough on its own. The goal is a setup where saying I don't have my second factor today leads to a slightly longer process rather than a locked door.

11:53 The day that changes is the day your team starts looking for ways around you. And that's the failure mode of a rollout that looked like a success. The mistakes that undo the whole thing. There are six habits that break MFA, and most of them aren't settings at all. One is choosing a second factor that lives in the same bucket as your password. A security question isn't a second factor, and neither is a second password. If both pieces of proof come from your memory, then one good guess about your life defeats both. Approving a prompt you didn't trigger is another. That single tap is the entire trick behind a push bombing attack. If your phone asks you to approve a sign in, you didn't start. The answer is no. And then you go change your password. Then there's the mess of old methods still attached to the account, like an old phone number, a spare email you stopped checking, or a hardware key sitting in a drawer.

12:37 Every enrolled method is a door, and a door you've forgotten about is a door somebody else can use. Administrators have their own version of this problem, because letting them sign in with a text message as their only option protects the least. The people who matter most. Your admin accounts are the ones an attacker actually wants. So if anyone deserves a security key or a pass key, it's them. Skipping recovery until the day it's needed is how a security upgrade turns into an outage. Recovery is the least exciting part of MFA, and it's the part that decides whether people end up trusting the whole thing. And the last habit is the slowest one. Treating MFA as a finish line, turning it on and walking away leaves you blind to the thing you were worried about in the first place. The sign in logs exist for a reason, and somebody should be reading them, because a failed run of prompt bombing against your tenant shows up in those logs long before it succeeds.

13:24 Where this leaves you. So here's where all of this lands. A password is one secret, and one secret is one leak away from being somebody else's. MFA adds a second, different kind of proof, and which one you choose decides whether you're slowing an attacker down or stopping them. Cold phishing resistant is the phrase worth remembering, because it's the difference between a code you can be talked into, reading out, and a key that simply refuses to help. If you take nothing else from this, take the order, turn on any MFA today, and upgrade to a key or a pass key when you can. And that leaves you with one question worth sitting with. Of all the things you'll sign into tomorrow, how many would still hold if the password were already in somebody else's hands?