Sessions
Multi-factor authentication (MFA)
Authentication that requires two or more different kinds of evidence — something you know, have, or are.
What Multi-factor authentication (MFA) means
Multi-factor authentication requires evidence from more than one category — knowledge (a password), possession (a device or key) or inherence (a biometric) — so that compromising one factor is not enough. Its strength varies widely: SMS codes and authenticator-app codes can be phished in real time; passkeys and security keys cannot.
Defined in: NIST SP 800-63B; OWASP Multifactor Authentication Cheat Sheet.
How it works
NIST SP 800-63B treats SMS and voice one-time passwords as restricted authenticators because of SIM swapping and interception, and defines phishing resistance as a property of the authenticator rather than the number of factors.
In a multi-tenant product MFA is usually a tenant policy: some customers require it, others leave it to users.
The mistake people actually make
Allowing MFA to be bypassed at account recovery or by a 'remember this device' cookie that never expires. The bypass becomes the real security level.
In Authreads
How this applies here
Available today: passkeys, authenticator apps (TOTP), emailed one-time codes and single-use recovery codes, with per-tenant method policy and step-up. Tokens report the achieved strength in amr and acr.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Guides that go deeper
- Passkeys for developers: how WebAuthn sign-in works
- MFA methods compared: SMS, TOTP, push, email codes and passkeys
- What makes authentication phishing-resistant?
- Step-up authentication: asking for more proof only when it matters
- Defending login against credential stuffing and password spraying
- Designing account recovery that is not the weakest link
Related terms
Passkey
A phishing-resistant sign-in credential: a key pair, scoped to one website, created and used through WebAuthn.
WebAuthn
The W3C browser API for creating and using public-key credentials such as passkeys and security keys.
Hosted login
A sign-in page served by the identity provider, which the application redirects to.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.