multi-factor authentication

Security Patterns

Meaning

Multi-factor authentication (MFA) is a security mechanism that requires users to present two or more independent verification factors—something they know (e.g., password), something they have (e.g., token or smartphone), or something they are (e.g., biometric)—to gain access to a system. It is applied when protecting sensitive data, privileged accounts, or any resource where credential theft must be mitigated.

Primary Function

Security / Access control

Communicative Purpose

Verify identity using multiple distinct credentials to reduce the risk of unauthorized access

Pattern

if verify_password(username, password) and verify_second_factor(username, token): grant_access(username)

Core Structure

if ... and ... : ...

Função primária

Security / Access control

Propósito comunicativo

Verify identity using multiple distinct credentials to reduce the risk of unauthorized access

Situações de gatilho

Implementing login flows for web applications, securing API endpoints, protecting administrative consoles or cloud infrastructure

Contextos

Web apps, enterprise SaaS platforms, cloud services, DevOps pipelines, and any system handling personal or financial data

Padrão

if verify_password(username, password) and verify_second_factor(username, token): grant_access(username)

Estrutura central

if ... and ... : ...

Slots de substituição

username: str, password: str, token: str (OTP or similar), verify_password: function(username, password) -> bool, verify_second_factor: function(username, token) -> bool, grant_access: function(username) -> None

Colocados típicos

password hashing (bcrypt
argon2)
session management
OAuth/OpenID Connect
rate limiting
audit logging

Substituições comuns

SMS OTP
email magic link
hardware token (YubiKey)
push notification
biometric scan (fingerprint/FaceID)

Erros comuns

Relying solely on passwords, using weak or guessable second factors, storing secrets in plaintext, failing to invalidate tokens after use, neglecting backup/recovery mechanisms

Similar / contraste

Single-factor authentication (password only) – less secure; Adaptive authentication – adjusts factor requirements based on risk context

Interferências

Coming from languages or frameworks without built‑in auth libraries: may assume MFA is just adding another password field rather than a distinct verification step

Família do chunk

password hashing
session management
OAuth/OpenID Connect
single sign-on
rate limiting

Nuance

MFA adds user friction; consider offering fallback methods, backup codes, and clear recovery paths. Overly strict MFA can hinder usability; balance security with user experience. Some factors (e.g., SMS) are vulnerable to SIM‑swap attacks.

Efeito pragmático

Significantly raises the barrier for credential‑theft attacks, reducing account compromise risk

Dica de memória

Something you know, have, are

Nota

When designing MFA, ensure the second factor is delivered over a secure channel and consider fallback mechanisms for account recovery.

Upgrade path

Implement adaptive risk‑based authentication that adjusts required factors based on contextual risk signals

Frequência: MediumFormulaicidade: FlexibleTipo de construção: conceptPrioridade de aquisição: Active recallPrioridade de output: BothTag de espaçamento: Medium-term

Examples

import pyotp import time def verify_password(user, pwd): # placeholder: compare hash return True def verify_second_factor(user, token): totp = pyotp.TOTP('base32secret3232') return totp.verify(token) def grant_access(user): print(f'Access granted for {user}') username = 'alice' password = 'correcthorsebatterystaple' token = pyotp.TOTP('base32secret3232').now() if verify_password(username, password) and verify_second_factor(username, token): grant_access(username)

# Pseudocode for a generic MFA check function login(username, password, second_factor): if check_password(username, password) and check_second_factor(username, second_factor): start_session(username) return "success" else: return "failure" # Example usage result = login('bob', 's3cr3t', generate_totp('bob_secret')) print(result)

class AuthService: def __init__(self, user_store): self.user_store = user_store def authenticate(self, username, password, otp): user = self.user_store.get(username) if not user or not user.check_password(password): return False if not user.verify_otp(otp): return False self.user_store.start_session(user) return True # Usage store = InMemoryUserStore() auth = AuthService(store) if auth.authenticate('carol', 'pwd123', '123456'): print('Logged in') else: print('Failed')