Multi-Factor Authentication (MFA)

MFA means requiring two or more different factor types — not the same password typed twice, and not "password plus the same password emailed to you." Security designers group factors into three classic families. Strong MFA mixes families so one theft channel cannot collect everything.

Saying "we use MFA" is incomplete. The second factor's strength depends on how hard it is for a remote attacker to steal or replay it. Rank factors by resistance to common attacks, then choose the strongest option each service offers — especially for crown-jewel accounts.

Classic remote takeover: attacker steals or phishes the password, then logs in from another country. With MFA, that login prompts for a second factor the attacker does not have. You get a push or need a code they cannot see. That pause is your chance to change the password, revoke sessions, and report the phish before damage spreads.

MFA is not magic. Real-time phishing proxies and MFA fatigue push-bombing exist against weaker setups. Still, enabling authenticator MFA or passkeys raises the cost of attack dramatically compared with password-only accounts — especially for opportunistic criminals. Defense is about raising cost and shrinking blast radius, not claiming perfect immunity.

Operational habit: never approve an MFA prompt you did not just initiate. If a push arrives while you are idle, treat it as an active attack signal — deny it, change the password from a known-good bookmark, and review sessions. Backup codes belong offline, not only inside the same inbox the attacker is trying to steal.

Order matters. Secure the accounts that can reset or empty the others first. Work only on accounts you own. Save backup codes offline before you need them — a lost phone without backup codes is a self-lockout, not a security win.

# Priority order — do on YOUR accounts only
1. Primary email (password reset hub for almost everything)
2. Password manager account (vault of all other secrets)
3. Banking / payment apps
4. Work / school SSO
5. Cloud storage that holds ID scans / tax PDFs
6. Social accounts that can reset or dox you

# Typical authenticator (TOTP) flow
Settings → Security → 2-Step Verification / MFA
→ Choose Authenticator app (prefer over SMS when offered)
→ Scan QR with authenticator
→ SAVE BACKUP CODES offline (paper / sealed note / offline vault)
→ Confirm a test login works on a second browser/device if possible

# Passkey / hardware key (when offered)
Settings → Security → Passkeys / Security key
→ Register device or plug in key
→ Keep a second factor / backup method enrolled

# NEVER
# - share live MFA codes on phone calls, SMS, or chat
# - approve mystery push prompts you did not initiate
# - disable MFA "for convenience" after a stressful day
# - store backup codes only inside the same email inbox they protect

You now treat MFA as the net under password mistakes — and you can rank SMS, authenticator apps, and hardware keys / passkeys by real-world strength. Next — Biometric Authentication — the "something you are" factor, with its unique permanent risks when templates leak.