We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
This idea carries a full system design question on its own. Each walks through the full answer.
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 8-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
The 2024 Verizon DBIR reports that stolen credentials are involved in over 80% of web application breaches. Passwords get phished, leaked in database dumps, guessed from social media, and brute-forced. The Have I Been Pwned database holds over 13 billion compromised credentials. Your users reuse passwords. That is not a possibility, it is a measured fact: a Google/Harris Poll survey found 65% of people reuse passwords across multiple sites.
MFA adds a second barrier. Even when the password is compromised, the attacker still needs a second factor: a phone, a hardware key, a fingerprint. Google reported that adding any form of MFA blocked 100% of automated bot attacks and 99% of bulk phishing attacks.
After deploying hardware security keys to all 85,000 employees in 2017, Google had zero successful account takeovers from phishing. Zero. That one fact tells you everything about the value of strong MFA.
MFA combines factors from at least two of three categories:
| Category | What It Means | Examples | Strength |
|---|---|---|---|
| Knowledge | Something you know | Password, PIN, security question | Weakest. Can be phished, guessed, or leaked. |
| Possession | Something you have | Phone (TOTP app), hardware key (YubiKey), smart card | Strong. Attacker needs physical access. |
| Inherence | Something you are | Fingerprint, face scan, iris scan | Strong. Hard to steal. But biometrics cannot be rotated if compromised. |
Not all MFA methods are equal. SMS codes are possession-based, but they can be intercepted via SIM swapping (the attacker calls your carrier and transfers your number to their SIM). The SS7 protocol that carries SMS has known vulnerabilities. In 2019, a Europol investigation found organized crime groups running SIM swap operations at scale.
Hardware keys (YubiKey, Titan) are the gold standard. The key is cryptographically bound to the specific domain. Even a pixel-perfect phishing site at g00gle.com fails because the key checks the real domain before signing the challenge.