MFA
Multi-Factor Authentication
Mehrfaktorauthentisierung
MFA requires more than just a password when logging in: in addition, at least one further, independent factor is needed — such as a code from an app, a hardware key or a biometric trait. Even if a password is stolen, access thus remains blocked. MFA is one of the most effective single measures against account takeovers.
History & facts. The factors are classically divided into „knowledge“ (password), „possession“ (token, smartphone, security key) and „inherence“ (biometrics). Because passwords are compromised en masse through phishing, leaks and reuse, a second factor raises the bar considerably. However, not all methods are equally strong: codes by SMS or simple confirmation push messages can be defeated by phishing or „MFA fatigue“ (exhaustion through constant requests). Considered especially robust are phishing-resistant methods based on FIDO2/WebAuthn with hardware security keys or passkeys.
Outlook & recommendation. MFA should be mandatory wherever access is concerned — especially for e-mail, remote access, privileged accounts and administration interfaces. The switch to phishing-resistant methods is recommended, since attackers increasingly bypass weak MFA in a targeted manner. MFA is at the same time a load-bearing building block of Zero Trust and, in many frameworks (such as within NIS2 measures), effectively expected. A well-thought-out recovery process remains important so that the second factor does not itself become a weakness or a lockout trap.