Multi-factor authentication facts for kids

Hardware authentication security keys

Multi-factor authentication (MFA), also known as two-factor authentication (2FA), is a special way to protect your online accounts, like your games, social media, or school portals.

Instead of just using a password, you need to prove who you are in two or more different ways. This makes it much harder for someone else to get into your accounts, even if they somehow find out your password. Using MFA helps keep your personal information and digital stuff safe from online bad guys. It's a really good idea to turn it on whenever you can!

How You Prove Who You Are Online

When you try to log into an online game or app, the system needs to know it's really you. This is called authentication. Usually, you just use one thing, like a password. But for extra safety, MFA asks for more than one type of proof. Think of it like needing two keys for a treasure chest instead of just one. If someone doesn't have all the right keys, they can't get in.

MFA uses different kinds of "factors" to check your identity. These factors are usually:

• Something you know: This is a secret only you know. Like your password or a special PIN number.
• Something you have: This is a physical item that belongs to you. It could be your phone, a special security key, or a bank card.
• Something you are: This is something unique about your body. Like your fingerprint, your face, or even your voice.

For example, when an adult uses an ATM to get money, they need their bank card (something they have) and their secret PIN (something they know). Both are needed to complete the transaction. Another common way is to use a password (something you know) plus a special code sent to your phone (something you have). Some apps, called authenticator apps, create these special codes right on your phone. These codes change very often, making them super secure!

What You Know: Passwords and PINs

The most common way to prove who you are is by using something you know. This is usually a password or a PIN (Personal Identification Number). A password is a secret word or mix of letters, numbers, and symbols. A PIN is usually a short number code. You need to remember these secrets. Many MFA systems still use a password as one of the ways to check your identity. It's important to make your passwords strong and unique for each account.

What You Have: Security Keys and Devices

An RSA SecurID token, which generates one-time passwords.

This factor uses something you physically own. Just like a key opens a door, a special device can unlock your online account.

• Security Tokens: These are small devices that generate special codes or connect to your computer.
  • Disconnected tokens show a code on a tiny screen. You then type this code into your computer. The code changes every few seconds.
  • Connected tokens plug directly into your computer, often into a USB port. They send the information automatically. Examples include USB security keys or smart cards.

A USB security token

• Software Tokens: These are like digital keys stored on your phone, tablet, or computer. An app on your device can create the special codes needed to log in. This is handy because you usually have your phone with you.

MFA is also used in real-world places, like when you use a special card or fob to get into a building. Sometimes, you might also need to show your face to a scanner to get in.

What You Are: Biometrics

This factor uses unique parts of your body to prove it's you. These are called biometrics. Common examples include:

• Your fingerprint
• Your face (like Face ID on a phone)
• Your voice
• Even the way you type on a keyboard can be unique to you!

Biometrics are very convenient because you don't need to remember anything or carry a device.

Where You Are: Location as a Factor

Sometimes, where you are can also be a factor in proving your identity. For example, if you're logging in from your home computer, a system might ask for less proof. But if you're trying to log in from a new or unusual place, it might ask for more steps. This helps protect your account if someone tries to access it from somewhere they shouldn't be.

Using Your Phone for MFA

Your mobile phone is a very popular tool for MFA. It's often used because most people carry their phones everywhere.

• SMS Codes: Many services send a special code to your phone via text message (SMS). You then type this code into the login screen.
• Authenticator Apps: These apps generate changing codes right on your phone, even without internet.
• Push Notifications: Some apps send a message to your phone asking you to tap "Approve" to log in.

An example of a mobile phone app showing one-time passwords.

Good Things About Phone MFA

• You don't need to carry an extra device, just your phone.
• The codes change often, making them safer than fixed passwords.
• It's usually easy and quick to use.

Things to Watch Out For with Phone MFA

While convenient, using your phone for MFA has some things to be aware of:

• Phishing Attacks: Be careful of fake websites or messages! Attackers might send you a text or email that looks real. It might ask you to click a link and enter your MFA code. Always check the website address very carefully before typing anything. Never share your MFA codes with anyone!
• Phone Issues: Your phone might get lost, stolen, or run out of battery.
• No Signal: If you don't have phone service, you might not get the code.
• SIM Swapping: This is when someone tricks your phone company into giving them a copy of your phone's SIM card. This lets them get your codes.
• SMS Security: Text messages are not always super private. Someone might be able to intercept them.
• Lost Phone Risk: If your phone is lost and not locked, someone could access your emails and texts, potentially getting into your accounts.

Rules for Using MFA

Because MFA is so important for security, many rules and laws require its use, especially for protecting sensitive information.

• Protecting Payments: Rules like the Payment Card Industry (PCI) Data Security Standard say that businesses must use MFA to protect credit card information. This helps keep your parents' money safe when they shop online.
• European Union: In Europe, there are rules that require strong authentication, often MFA, for most online payments.
• India: In India, the central bank has rules for online payments, often requiring two-factor authentication for debit and credit card transactions.
• United States: The U.S. government has rules for its own computer systems. These rules require MFA to protect important government information. Laws like HIPAA also require MFA to protect private health information. These rules help make sure your personal data is kept safe.

Staying Safe: What to Watch Out For

While MFA makes your accounts much safer, it's not perfect. Smart online tricksters are always trying new ways to get around it.

• Phishing Attacks: Be careful of fake websites or messages! Attackers might send you a text or email that looks real. It might ask you to click a link and enter your MFA code. Always check the website address very carefully before typing anything. Never share your MFA codes with anyone!
• MFA Fatigue Attacks: Imagine your phone keeps buzzing with login requests, one after another. This is an MFA fatigue attack. Attackers hope you'll get annoyed and accidentally tap "Approve" just to make the requests stop. Always check if you actually tried to log in before approving a request. If you didn't try to log in, do not approve it!
• SIM Swapping: As mentioned before, this is a trick where someone tries to get a copy of your phone's SIM card. This lets them receive your text messages and codes.

These attacks show why it's important to be alert. Even with MFA, always be careful about what you click and what information you share.

How MFA Systems Are Used

Setting up MFA can sometimes be a bit tricky for companies and organizations.

• Software Needed: Some MFA systems need special software installed on your computer. This can be complicated to manage for many users.
• Hardware Challenges: If a company uses physical security tokens, they need to make sure everyone gets one. These tokens can also get lost or broken.
• Cost: Setting up and maintaining MFA systems can cost money for businesses.
• User Experience: Sometimes, MFA can feel a bit slow or difficult for users. Companies try to find a balance between being super secure and easy to use.

Even with these challenges, many organizations, like banks and governments, use MFA. They know it's a very important step to keep information safe. It's like adding extra locks to a very important building.