What is MFA, and why it matters.

A password is a secret, and secrets leak. They get phished, reused across sites, guessed from a breach dump, or typed into a convincing fake login page. For decades the entire security of an account rested on that one fragile thing, and attackers built an industry around collecting it. Multi-factor authentication, usually shortened to MFA, is the industry's answer to that fragility. It refuses to treat a password as sufficient proof and demands a second, independent signal before it trusts you.

The idea is old and simple. To take money out of a bank machine you need the card and the PIN. One without the other is worthless. MFA applies the same logic to a login. Even if an attacker knows your password, they still have to produce the second factor, and that second factor is something they usually cannot obtain from a database leak or a phishing email. This post explains the three kinds of factors, walks through the ways MFA is delivered from weakest to strongest, and shows where it fits alongside single sign-on in a real account setup.

The three factor types

Security people group authentication factors into three families, and the word "multi" in MFA means the proofs come from different families, not the same one twice. Two passwords are not multi-factor, because both are the same kind of secret and both fail the same way. Real MFA combines categories so that a single class of attack cannot defeat all of them at once.

The first family is something you know. A password, a PIN, or the answer to a security question. It costs nothing to deploy and is easy to understand, which is why it became universal, but it is also the easiest factor to steal, because knowledge copies perfectly and silently. Once someone else knows your secret, you often have no way to tell.

The second family is something you have. A phone that receives a code, an authenticator app that generates one, or a small hardware key you plug in or tap. Possession is harder to steal at scale because an attacker has to get at a specific physical thing, not just copy a string of characters from a breach. This is the family that does most of the real work in modern MFA.

The third family is something you are. A fingerprint, a face scan, or another biometric trait read by a sensor on your device. Biometrics are convenient and hard to hand over by accident, though they raise their own questions about privacy and about what happens if the underlying data is ever compromised, since you cannot reset a fingerprint the way you reset a password.

Why a second factor stops most attacks

Look at how real account takeovers begin and the value of MFA becomes obvious. The overwhelming majority start with a credential the attacker did not have to break. They buy a list of passwords from an old breach and try them against other sites, betting that people reuse them. They send a message that lures someone to a fake sign-in page and capture what gets typed. They spray a handful of common passwords across thousands of accounts and wait for a hit. Every one of those techniques ends the same way, with the attacker holding a valid username and password.

Against an account protected only by a password, that is game over. Against an account protected by MFA, the attacker reaches the second gate and stops, because they do not have your phone, your authenticator app, or your hardware key. The single most repeated finding in account security research is that turning on MFA blocks the large majority of these automated, credential-based attacks. It does not make an account unbreakable, and I will be honest about its limits below, but it removes the cheapest and most common path an attacker takes.

This is also why security teams treat MFA as a baseline rather than a luxury. It is one of the few controls where the cost to enable it is small and the reduction in risk is large. If you do one thing after reading this, turn it on for your email and your password manager, because those two accounts can be used to reset almost everything else you own.

The spectrum from SMS codes to passkeys

Not all second factors are equally strong. They sit on a spectrum, and knowing where each one lands helps you choose well and understand why some organizations push you toward specific methods.

At the weaker end are one-time codes sent by SMS. They are far better than no second factor at all, and for most people they are a reasonable default. But a text message can be intercepted, and attackers have learned to trick phone carriers into moving a victim's number to a new SIM card, which redirects the codes to them. A code delivered by SMS is also still a secret you can be talked into reading aloud to someone posing as support.

In the middle are authenticator apps that generate a rotating six-digit code on your device, following an open standard so any app works with any service. These are stronger than SMS because the code never travels over the phone network and cannot be redirected by a SIM swap. Their remaining weakness is that a convincing fake login page can still ask you to type the current code, and if you do, an attacker relaying it in real time can get in.

At the strong end are passkeys and hardware security keys, which use public-key cryptography instead of a shared code. Your device holds a private key that never leaves it and proves your identity to the site without sending anything an attacker could reuse. Crucially, these methods are bound to the real website's address, so a fake page cannot trick them, which makes them resistant to phishing in a way that codes are not. Passkeys bring this protection to ordinary users through the fingerprint or face unlock already on their phones and laptops, which is why the whole industry has been moving toward them.

How MFA works with single sign-on

MFA and single sign-on are often confused, but they solve different problems and are strongest together. Single sign-on lets one trusted login open many applications, so a person authenticates once and moves between tools without signing in again. On its own, that convenience is a double-edged thing, because if one login opens everything, then that one login is worth a great deal to an attacker. If you would like the full picture of how that works, I wrote a separate guide to what single sign-on is and how it works.

MFA is what makes single sign-on safe to rely on. You attach a strong second factor to the single login, and now that concentrated point of access is also the best-defended one. The person still gets the convenience of signing in once, and the organization gets the assurance that the single door is not guarded by a password alone. This is the standard pattern in any serious account setup: centralize the login, then protect that centralized login with MFA.

It is worth being precise about categories here, because the words get blurred in marketing. An identity platform is what actually issues the login and enforces the MFA policy. A product you sign in to is a different thing. wrxstack sits in that second group. It is an AI work platform, not an authentication vendor, and it connects to the identity provider your organization already runs through standard single sign-on so your existing MFA policy applies at the door. It does not try to be the place where your MFA lives, and it would be dishonest to suggest otherwise. You can read what it does and does not handle on the security page.

The honest limits of MFA

MFA is one of the best security investments available, and it is still not a wall around your account. Being clear about its limits is the difference between real security and a false sense of it. Weaker factors like SMS can be redirected. Code-based factors can be captured by a real-time phishing page that relays what you type. Attackers have also learned to wear down people who use push-approval prompts by sending a flood of requests until someone taps approve just to make the buzzing stop, a tactic worth knowing so you never approve a prompt you did not start.

The response to these gaps is not to abandon MFA. It is to move toward the phishing-resistant end of the spectrum, to use passkeys or hardware keys for accounts that matter most, and to pair the whole thing with the wider discipline of good defaults across a system. I have written before about why strong security has to be built into how a product behaves rather than bolted on, in a piece on what privacy by default actually requires. MFA is a central part of that story, but it is one control among several, not a finish line.

What to turn on, and in what order

If you are setting this up for yourself, start with the accounts that can open the others. Protect your primary email and your password manager first, because whoever controls those can reset the rest. Use an authenticator app rather than SMS where you have the choice, and adopt passkeys wherever a service offers them, especially for financial and work accounts. Keep a backup method or recovery codes stored somewhere safe, because losing your only second factor can lock you out of your own account.

If you are setting this up for an organization, the highest-value move is to require MFA on the single sign-on login that gates access to your business tools, and to prefer phishing-resistant methods for administrators and anyone with sensitive access. Buyers evaluating a work platform reasonably ask how it fits that model, which is why we describe our approach plainly on the enterprise page rather than implying capabilities the product does not have. The right posture is the same for a person and a company: make the login worth defending, then defend it with more than a password.