By Hackermane — Guest Contributor, Tech Scene Media
Now that your passwords are all managed and safely locked away, you might feel like your accounts are invincible. If only it were that easy. While a unique, complex password is a massive leap forward, a username and password combo is still a single point of failure. I'd love to discuss the weaknesses of traditional credential systems in a future article, but for now, let's focus on how to add a second layer of protection: Multi-Factor Authentication (MFA).
The core idea of MFA (sometimes called 2FA) is simple: instead of relying on one single "key," you require at least two different types of proof to let you in. In the security world, we generally look at four distinct categories: something you know, something you have, something you are, and some**where** you are.
Your password falls squarely into the bucket of something you know. However, it’s a common mistake to think "security questions" count as a second factor. They don't. If you use your password as factor one, and the name of your first pet as factor two, an attacker who finds you on social media can easily guess both. If you know it, a clever hacker can eventually know it, too.
Next is something you have. This is often where people start their MFA journey. A great example is your smartphone; by receiving a verification code via text or—even better—using an Authenticator app, you prove that you physically possess a specific device. There are also FIDO2/U2F hardware security keys, which are often considered "unbreakable"; these are tiny USB/NFC devices you plug into your machine. They offer incredible security with a small cost of convenience (having another physical item to carry and manage across different devices).
Then, there is something you are. This relies on biometrics, the biological "fingerprints" that make you unique. This could be a fingerprint scan, facial recognition (FaceID), or an iris scan. While some might argue that a DNA test would be the ultimate biometric, thankfully, most login screens aren't yet equipped to take blood samples.
Finally, there is somewhere you are. This uses your physical location, determined via GPS or IP address, to verify your identity. The idea is that if you always log in from London, a login attempt from Singapore should trigger an alarm. However, this method has a notable weakness: location data can be spoofed or faked. Because of this, you’re more likely to encounter "geoblocking"—where a service prevents access based on your perceived location—rather than using location as a reliable way to grant access.
Passkeys and going passwordless is also all the rage these days, plus I’m sure you still wanna know about how password exploits happen (and what to do about them). Stay tuned for our upcoming articles to learn more! If you have your own infosec questions, don't hesitate to reach out to Hackermane!
Catch up on the series:
Guest Writer: Hackermane is a Memphis-based security expert and organizer of Midsouth Makers and Memphis Info Security, two meetups built on the same premise as this article: the threats are bigger than any one person, but the people in the room are how the city gets ahead of them anyway. Learn more or hang out: https://hackermane.com/