Authentication verifies identity.

Examples:

• passwords
• certificates
• hardware tokens
• biometrics

MFA combines multiple independent factors.

Typical factors:

• something you know
• something you have
• something you are

MFA significantly reduces risk from:

• password reuse
• phishing
• credential leaks

MFA is not perfect.

Possible weaknesses:

• MFA fatigue attacks
• session hijacking
• social engineering
• SIM swapping