2FA became ubiquitous within the last ten years. But actually, it’s been in use since the very early days of IT security. In the very early days of software, expensive software suites usually came with something called a "dongle." That dongle was a physical device that plugged into a port on your computer. So, you had a login name, password, and dongle to run the software suite.
Highly secure systems have always required that you insert a card or USB to access them. But when smartphones started to become more common, the smartphone device itself started to become the second factor.
“Two-factor” generally refers to something you "know" (password) and something you "have" (an email, smartphone, or other device). And it's a very secure method, because it means that someone can't hack into your accounts with a password alone.
For the purposes of usability, most sites don't ask for 2FA every time. Instead, they start to recognize the device you're using. Then, if you use a device that they don't recognize, then they prompt you to validate that device.
Multi-Factor Authentication: A Step Beyond
First: All other things being equal, MFA is always more secure than 2FA. 2FA is MFA, but not all MFA is 2FA. What does that mean?
2FA uses two items. Multi-factor authentication uses two or more items for authentication. Using a password and an email address, for instance, is always going to be inherently less secure than using a password, email address, and also a physical device.
But the "other things being equal" does factor in. For instance, using a password and a physical biometric scanner might still be more secure than using a password, email, and dongle. You can compromise a password or email and steal a dongle. But it's far less likely that you could counter a high-level physical biometric scanner.
That's really the only difference. 2FA uses two factors and multi-factor uses more. Multi-factor is becoming more popular today, because it is inherently more secure. It can still be implemented poorly.
2FA vs. MFA
There are more things to consider, of course, than just security. When it comes to MFA vs. 2FA, there's also user experience to take into account.
Consider this: In many systems, employees are asked to create a new password every month. But that actually often leads to a less secure system. Why? Because employees cannot remember passwords so frequently, so they start writing them down.
When users find a system cumbersome to use, they start finding ways to work around it. And because they try to work around it, they end up making it less secure.
MFA is more secure than 2FA. But many companies still use 2FA for two reasons. One, it's cheaper and easier to setup. Most software suites support 2FA, but not all of them support MFA. Second, it's easier for the user. The user doesn't want to have to chase down all these verification methods.
That's not necessarily an entreaty to avoid MFA. Rather, companies should be knowledgeable about the challenges of MFA and MFA adoption and should endeavor to make it as simple and easy as possible.
Using 2FA or MFA – or Passwordless
Regardless of whether an organization chooses to use 2FA or MFA, it should use one of them. 2FA has become an industry standard for a reason. Without 2FA, it's very easy to break into accounts. This is especially true because more employees are working from home and working from a multitude of devices.
Companies should at minimum have 2FA and, if they want to future-proof their systems, they should adopt MFA. Ultimately, the end goal for a business should be to ultimately eliminate passwords altogether. The best passwordless MFA systems are user-centric and unify a variety of authentication solutions under one banner, letting businesses give their employees secure access without needing to use multiple credential platforms. Passwordless MFA should be the end goal of any business, perfectly melding security and convenience.
At Axiad, we provide a SaaS authentication platform and product line for all your authentication needs, providing your users with a seamless experience and your organization a boost in its security. Request a demo today to find out more about how Axiad can provide passwordless orchestration across your organization.