We see it almost every day in the news. An organisation is hacked because someone had an easy-to-guess password, or someone clicked on a fake link and gave criminals access to important systems. Chaos ensues.
Everyone immediately says: “You should have used multi-factor authentication (MFA)!” That is certainly smart advice. MFA asks not only for a password, but also for something else, such as a confirmation on your phone. But MFA is not perfect. Clever attackers sometimes find ways to get around it.
People are the biggest factor
The Verizon report on data breaches in 2023 states that in 74% of all hacks, people were the “problem”. Almost half of those were due to stolen passwords and 12% due to phishing. If more people used MFA, the share of stolen passwords would be much lower. But that 74%? We really need to stop and think about that. What do you actually know about online security? And what do you do every day to stay safe?
Why MFA is so effective
MFA is one of the most effective measures you can take. A password can leak or be guessed. With MFA, that password alone is not enough: the attacker also needs your phone, key or fingerprint. It greatly reduces the chance of misuse and makes an attacker’s work many times harder.
Which form of MFA do you choose?
Not every form of MFA is equally strong. In the second edition of The Digital Compass we list them:
- Text message codes are better than nothing, but vulnerable to interception and SIM swaps, where a criminal has your phone number moved to their own SIM card.
- An authenticator app, such as Microsoft Authenticator, is more reliable and easy to use. With a push notification you can even sign in without a password. Read how to set up Microsoft Authenticator.
- Hardware keys and passkeys are phishing-resistant: on a fake website they simply do not work. More in Passkeys: secure login without the hassle.
MFA is not a 100% guarantee
It is a myth that MFA makes you untouchable. With a fake login page, an attacker can sometimes take over your session, even if you use MFA. Phishing-resistant forms offer the most protection, but take a few more steps: more hassle in exchange for more security. Read more myths in “We are too small for hackers” and six other cybersecurity myths.
Knowledge makes the difference
We can no longer pretend online security does not concern us. Not at home, and not at work. You do not have to become an expert, but knowing the basics matters. Know what a phishing email looks like, distrust time pressure and strange payment requests, and report it when something is off. How such an attack unfolds in practice, you can read in Invoice fraud in four phases.
In short
MFA is an extra lock on the door. But a lock alone is not enough. Use MFA wherever you can, choose an app or passkey over text messages, use unique passwords and do not click on strange links. More on getting logins right in A password policy that actually works.
