Your question is really more about definitions than about the actual real security of the system. So let's define some terms before getting to your question:
As I learned it, there are three broad categories of authenticators:
- Knowledge (something they know) - passwords and other secrets
- Possession (something they have) - access to an email account to retrieve the one-time PIN
- Inherence (something they are) - usually biometrics like facial recognition, finegerprint or iris scan
Borrowing from the tag wiki for multi-factor (which I wrote):
If you are required to provide a proof of identity from more than one of the above categories, then it is properly "Two Factor Authentication", or "Multi-Factor Authentication". If you are providing multiple items from the same category, then it's called "Multi-Step Authentication", which is obviously weaker than multi-factor.
Wikipedia seems to agree with this definition.
Cool. So as for your website,
I login to a website and provide a UserID, Password and one-time PIN delivered via EMail or SMS.
- Password = Knowledge
- Email/SMS = Possession.
==> Pass! This is MFA.
My question is, is the second login considered MFA (Password + registration cookie)?
- Password = Knowledge
- Cookie = Knowledge (of the text)? Possession (of the device)? Uncertain.
Arguments for "yes": if the cookie is implemented properly, then it counts as possession of the device.
Arguments for "no": possession-type factors really ought to be immune to record&replay attacks; with any kind of one-time codes - hardware tokens, apps, email, SMS, etc - the server won't let you use the same code twice. Same with crypto USB sticks / cards you need to insert into your laptop. In this case, someone intercepting your traffic to the website will snatch both your password and cookie in the same packet and then be able to log in as you somewhere else.
That said, it does protect your account against, for example, their password database getting stolen, or you re-using a password of yours from a different site that shows up in a leaked passwords database. Questionable.
On a technicality it probably is 2FA / MFA, and offers more security than either password or cookie by itself, but less than continuing to do the Email / SMS thing.