Second factor (MFA): what it is and how it is attacked
A second proof of identity beyond the password.
Also known as
- MFA
- 2FA
- multi-factor authentication
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It removes the value of a stolen password on its own, which is why the systems it does not cover are where intrusions tend to start. How much it removes depends entirely on which second factor: a hardware key resists the phishing that intercepts a code or a prompt.
How it gets attacked, and what reduces it
How it gets attacked
- Repeated approval prompts until somebody accepts one
- Sign-in paths that were never covered by it
What reduces it
- Prefer a hardware key or passkey, which is bound to the site and resists relay; a code or prompt is not
- Cover every sign-in path, because the one that was missed is the one that gets used
- Alert on a factor being registered through account recovery, which is how a real one gets replaced
Where it sits
- Group
- Identity · Who something claims to be, and what proves it.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- second-factor
Reviewed . CC BY 4.0.
Others in identity
- Sign-in serviceIdP · SSO · identity provider · Entra ID · OktaThe single service that proves who someone is, for every application.
- Directory serviceActive Directory · AD · DC · LDAP · domain controller · staff directory · identity storeThe system that holds every account and computer, and decides what each one is allowed to do.
- Machine accountservice account · robot account · non-human account · application accountAn account used by software rather than by a person.
- CertificateTLS certificate · PKI · code signing certificateA digital document proving something is genuinely what it claims to be.
- Access badgeproximity card · prox card · RFID card · fob · smart card · staff passThe card or fob a person holds against a reader to open a door.
The identity group lists all 6 of them side by side.
Second factor on your own diagram
Open the editor, press N, and type MFA. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker