What is the difference between multifactor authentication and single-factor authentication?

Last updated on September 14th, 2022

TL;DR of MFA vs. 2FA: Two-Factor Authentication (2FA) requires users to demonstrate exactly two distinct authentication factors, whereas Multi-Factor Authentication (MFA) requires users to demonstrate at least two distinct authentication factors. So, all 2FA is MFA, but not all MFA is 2FA.

If you are new to the world of cybersecurity, terms such as MFA and 2FA may appear rather cryptic to you. Sometimes MFA and 2FA are used interchangeably, but although similar, they are not the same thing. Both acronyms have been in wide use for years and happen to be an inseparable part of what Rublon does, so let’s once and for all clear up the confusion around MFA and 2FA.

Preliminary Definitions

In order to fully comprehend what MFA and 2FA are, you have to understand two concepts: that of authentication and that of a factor of authentication.

Authentication is a process during which a security system decides if the person who tries to log in is exactly whom they claim to be.

The preceding definition entails that a security system has to find a way to ensure that the person who tries to log in as Bob is indeed Bob. The security system cannot grant access to Alice or a malicious attacker. How can a security system know that the person is Bob? Well, Bob has to successfully present adequate evidence of their identity and then and only then will they be granted access.

A factor of authentication is a piece of evidence that a user has to present to prove they are who they claim to be. 

The three basic Factors of Authentication are:

• Knowledge Factor – represents what you know, e.g. a password
• Possession Factor – represents what you have, e.g. a phone, a security token
• Inherence Factor – represents who you are, e.g. your fingerprint or eye retinal pattern

MFA vs. 2FA

Multi-Factor Authentication (MFA) is a type of authentication that requires two or more factors of authentication.

Two-Factor Authentication (2FA) is a type of authentication that requires exactly two factors of authentication.

Two-Factor Authentication is, therefore, a subset of Multi-Factor Authentication, and the following two sentences are true:

• Every Two-Factor Authentication is Multi-Factor Authentication
• Not every Multi-Factor Authentication is Two-Factor Authentication

Why Is One Factor Not Enough?

The Knowledge Factor is the most commonly used factor of authentication. A password you enter every time you log in to an application is an example of the Knowledge Factor. Unfortunately, passwords have long proved insufficient in the contemporary world. Simply put, passwords are not secure enough. Cybercriminals invented a wide range of methods to intercept somebody’s password, from phishing to keylogging, to rainbow table attacks. If passwords are your sole line of defense against unauthorized access, then you better enable Multi-Factor Authentication in your workforce before it’s too late.

How Introducing More Factors Improves Security?

MFA adds more factors of authentication and therefore eliminates security threats associated with low security of passwords. You can think of every factor as an additional lock, with varying levels of difficulty of breaking them. If you introduce Rublon Two-Factor Authentication to your users’ login experience, then even if a malicious third party manages to break the weak lock (password), they will not be able to open the door because the strong lock (e.g. the Mobile Push authentication request method) will stop them.

The Mobile Push authentication method is an example of the Possession Factor. Mobile Push is one of the methods your users can use if they install the Rublon Authenticator mobile app. Assuming the attacker already broke your password, now they have to steal or gain remote access to your phone, which isn’t impossible but much harder than cracking a password. Stealing or gaining access to your phone requires additional steps on the attacker’s side, which in turn means more time for you to react. Simply tapping DENY on your phone will stop any malicious attempt at breaking into your account.

Human Error And More Factors of Authentication

Nobody’s perfect. It’s human to err. Sometimes you work under stress or pressure and it’s so easy to get distracted. Attackers know this and they will try to attack you when you are the weakest. You can make a mistake that will cost you your data and money. Two-Factor Authentication significantly mitigates the probability of human error but does not eliminate it. Introducing yet another factor of authentication will make your authentication even stronger and chances of human error negligible.

One way to further reinforce your MFA is turning on fingerprinting in your Rublon Authenticator.

With fingerprinting turned on, your Mobile Push Multi-Factor Authentication may look as follows:

Again, adding more factors of authentication is like adding more locks to your door, each lock harder to crack than the other. In the login example above, three factors of authentication were used:  Knowledge Factor (password), Possession Factor (phone), and Inherence Factor (fingerprint). Since three factors were used, the preceding is an example of Multi-Factor Authentication but not Two-Factor Authentication.

Enable MFA/2FA Now

To reiterate, MFA involves introducing more factors of authentication to the process of authentication. 2FA is a subset of MFA that involves using exactly two factors of authentication. Using just one factor in the form of a password is not secure enough, and that’s why you have to enable Multi-Factor Authentication in your company.

Time is of the essence. Now that you understand what MFA/2FA is and know how insecure using only passwords in your company is, enable MFA before it’s too late! Improving security should be your number one concern now. Do it today, and your users will thank you tomorrow.

Single or multi-factor? This is a question that, in our experience, gets asked quite frequently when planning an access control system. One might say that the more factors, the more security, the better... but is this really true? In certain cases, where security takes precedence, the answer is straightforward. In other cases, not so much.

Security level is not the only difference between single and multi-factor authentication, and as such, one must examine the question thoroughly, before choosing the method to be used.

This blogpost will examine these questions, primarily from a biometric standpoint, but we will also look at other solutions. This information is important for anyone who is planning access control for all, but the highest security places, where the highest possible security requirements override any other consideration.

First, we must clarify, that for the purposes of this post, multi-factor authentication means two entirely different factors (e.g. an ID number/PIN code combination is considered as single factor authentication). The reason for this is that if one can obtain e.g. a password, then one will most likely be able to obtain the user ID as well with roughly the same amount of effort - or, as a better example, one, who can obtain a particular fingerprint from a person will be able to obtain all the other prints as well with the same method, due to the nature of the factor. Thus, requiring two fingerprints from the same person does not add to the security level and can not be counted as multiple factors. Also, in single factor authentication, the starting point is biometry here, because neither possession nor knowledge based methods can really compete with it.

Single factor authentication

The biggest advantage of single factor authentication is its simplicity. It is always easier to perform one action for identification rather than many. This also means that this method is easy, does not require too much user cooperation and it is fast. Our experience shows that people tend to move towards the path of least resistance even in the field of security, so if presented with multiple options, they will (with the exception of security-conscious people) choose the easiest and fastest way. The only difference can be observed is when a person is interested in the security (e.g. online banking services) for his/her own sake, tougher security methods might be chosen to better protect the valuables. With convenient solutions, however, comes low security. A single factor - whatever it may be - is always easier to acquire for a malicious person than multiple factors, and the possibility of passing a security measure with an obtained factor is inversely proportional to the number of factors required. Using single factor authentication can be suggested at places, where high security levels are less important than good throughput performance, ease of use or relatively small required user cooperation.

Multi-factor authentication

Multi-factor authentication is, in contrast, when several factors are required to perform a successful identification. The most widespread methods are RFID+Password, RFID/Password+Biometry (which is also called as 1:1 verification) or multiple biometric factors. The number of possible combinations is rather high. Multi-factor authentication can give higher security levels with individually lower quality methods (e.g. a simple password and biometry is always stronger than a very hard to guess password and this is), as people with malicious intents have to take that extra mile to obtain all information and/or samples before attempting to spoof the system. If we consider this further, the level of security is determined by how difficult it is to obtain the hardest-to-obtain factor. This means that if, for example, a system uses a PIN code and a vein pattern, both have to be acquired for a successful identification. Alone, neither is enough to produce a successful identification, so that is why the hardest factor determines the overall security (of course, only from this standpoint - if the IT background or the devices themselves are vulnerable, that will adversely affect the whole system, but that is another question). And, as you might have suspected, there is a tradeoff between security and throughput - the higher the number of the factors that are required, the slower will it be to pass through an access point with the particular configuration. Also, it will require more user cooperation, which means that aside from the cases where the individual voluntarily starts to use multiple factors for his/her own benefit, companies will have to force users into multi-factor authentication. So use multi-factor authentication where security is more important than throughput (or user experience, for that matter).

A special case of multi-factor authentication is when two or more biometric features are used to perform identification. Here, the lines that separate the pros and cons of single- and multi-factor authentication start to get blurred. There are features, that can be checked within the same process, at the same time (e.g. fingerprints and finger veins - or palm veins - depending on the configuration), which gives the process speed akin to single factor authentication while retaining the security level of multi-factor authentication. Extending this idea, if a biometric factor needs cooperation, and during that a different factor can be examined with little to no further cooperation (e.g. palm veins and face recognition together), identification will be almost as convenient as with their single factor counterparts. Note, that this case might be considered a single factor method by some, as the multiple factors are from the same general type (biometric, that is). This is really on the edges of both realms, drawing the positive aspects from both while trying to mitigate the negative ones.