Multi-Factor Authentication

Multi-factor authentication (MFA) combines at least two different authentication factor categories: something you know, something you have, and something you are. Examples include a password or PIN, a phone or security key, and a fingerprint or face. A password plus a security key illustrates different categories; the number of prompts alone does not define MFA. Source: IAM Ecosystem Explained (04:17-05:32).

Strength Depends on the Method

MFA reduces reliance on passwords, but methods do not offer identical protection. The video highlights attacks involving phone numbers against SMS codes and repeated approval prompts that cause accidental approval. Microsoft Authenticator and Duo Mobile are examples, not a comparative evaluation of all configurations. Source: IAM Ecosystem Explained (04:17-05:46).

Passkeys use a protected private key and a public key stored by the service. Proving possession of the private key avoids transmitting it to the website. Binding the credential to the legitimate service resists fake-login-site Phishing. This explains the authentication mechanism; it is not evidence that every attack against the account or device is prevented. Source: IAM Ecosystem Explained (05:46-06:27).

Recovery and Context

A weak account-recovery or help-desk reset process can bypass strong normal sign-in. Recovery therefore belongs inside the authentication security boundary. The video identifies this requirement but does not provide a tested recovery procedure. Source: IAM Ecosystem Explained (06:27-06:47).

Adaptive authentication can request additional verification or block access when context is risky. An unusual-country login is a signal to assess, not proof of compromise; a VPN can explain apparent travel. Zero-Trust Access considers relevant conditions without requiring a fresh login for every click. These controls complement SSO and authorization, not replace permission enforcement. Source: IAM Ecosystem Explained (20:53-23:08).