Skip to main content

a multi factor authentication requires at least two sets of credentials. This is typically something you know (e. g. a password) and something you own (e. g. a token generator or mobile phone), but could also be something you are (a biometric).

  1. Something you know - information, like a password, or your mother's maiden name, or a public key stored in a key file.

  2. Something you have - usually a physical object like the phone that can receive SMS at your number, or a One-Time-Password (OTP) token or public-key enabled smart card / USB stick:

  1. Something you are: aka "biometric" like fingerprints, iris, voice, typing rhythm, etc.

The reason for splitting authentication methods into these categories is that each one requires a very different kind of theft in order for a hacker to acquire it.

If you are required to provide a proof of identity from more than one of the above categories, then it is properly "Two Factor Authentication", or "Multi-Factor Authentication". If you are providing multiple items from the same category, then it's called "Multi-Step Authentication", which is obviously weaker than multi-factor.