> MFA
> Definition(s):
> Authentication using two or more different factors to achieve authentication. Factors include: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric). See Authenticator.
> Source(s):
> NIST SP 800-53 Rev. 4 under Multifactor Authentication
You'd be in just about the same place if instead of saying "you need biometrics" you said "You need 2 devices".
Even number 2 can be done wrong. 2 Doesn't work if the thing you have is a knowledge based thing. 2 only works if in the case that it responds correctly to a stimulus. Think things like RSA.
You really are categorizing authentication factors by their weaknesses:
- Knowledge factors can be discovered/guessed and duplicated
- Possession factors should protect against guessing and duplication, but can be physically stolen
- Inherence factors should protect against guessing, duplication and physical theft, but cannot be replaced
Writing down a password doesn't make it an effective physical factor, just like embedding an NFC chip in your arm doesn't make it an effective biometric.
Similarly, SMS authentication is not #2. The mapping of your phone number to your phone is not something you possess, it is sitting in some phone company system somewhere and it can be changed.
Is this still a thing? It sounds decent to me. Most auth usually uses 1 or 2 from the list but rarely all 3.