Cybersecurity Foundations (Grades 6–8) · lesson 5 of 48 · 18 min
The Password Problem — and Why One Lock Is Not Enough
You now know how to build a strong, unique password. But here is an uncomfortable truth: even a perfect password can be stolen. Phishing tricks you into typing it on a fake site. Malware records it as you type. A data breach exposes it from a server you trusted. Once an attacker has your password, a single lock is all that stands between them and your account.
Multi-factor authentication (MFA) — also called two-factor authentication (2FA) — solves this by requiring a second proof of identity. Even if an attacker has your password, they cannot log in without the second factor, which only you possess.
Think of it like a bank vault: the vault has both a key and a combination dial. Stealing the key is useless without the combination. MFA works the same way — two independent locks, from two different categories.
MFA by the numbers
Microsoft’s security research found that MFA blocks over 99.9% of automated account compromise attacks. Google found that adding a recovery phone number (a form of MFA) blocks 100% of automated bots, 99% of bulk phishing attacks, and 66% of targeted attacks. It is the single most impactful security action an individual can take.
The Three Authentication Factors
Authentication factors fall into three categories. MFA requires at least two factors from different categories — using two passwords is not MFA, because both are “something you know”.
The power of MFA comes from combining categories. An attacker who steals your password (something you know) still cannot log in without your phone (something you have) or your fingerprint (something you are). They would need to compromise two completely different things simultaneously — which is dramatically harder.
Activity 1 — Classify the Factor
Sort each authentication method into the correct factor category.
Authentication Factor Classifier
- Your account password
- know
A password is a secret you memorise — something you know.
- Fingerprint scan on your phone
- are
A fingerprint is a biological characteristic — something you are.
- A YubiKey hardware token plugged into USB
- have
A YubiKey is a physical device you carry — something you have.
- A 6-digit PIN
- know
A PIN is a memorised number — something you know.
- Face ID on your phone
- are
Face recognition uses your physical appearance — something you are.
- A one-time code sent to your phone
- have
The code is delivered to your phone — a device you possess — making it something you have.
- Your mother’s maiden name (security question)
- know
Security question answers are memorised secrets — something you know. (And not very secure ones.)
- An authenticator app on your phone
- have
The app is on your phone — a device you possess. The codes it generates are tied to that device.
MFA Methods — From Weakest to Strongest
Not all MFA is equal. Here is a detailed look at each method, ranked from least to most secure.
1. SMS One-Time Codes (Least secure MFA)
When you log in, the site sends a 6-digit code to your phone via text message. You enter the code to complete login. This is better than no MFA, but it has a critical weakness: SIM swapping.
In a SIM swap attack, the attacker calls your phone carrier, impersonates you using personal information gathered from social media or data breaches, and convinces the carrier to transfer your phone number to a SIM card the attacker controls. From that point, all SMS messages — including your MFA codes — go to the attacker’s phone. High-profile victims of SIM swapping have lost millions of dollars in cryptocurrency and had social media accounts taken over.
2. Authenticator App TOTP Codes (Good)
Apps like Google Authenticator, Authy, and Microsoft Authenticator generate Time-based One-Time Passwords (TOTP) — 6-digit codes that change every 30 seconds. The codes are generated locally on your device using a shared secret established when you scanned the QR code during setup. They never travel over the network, so SIM swapping cannot intercept them.
The weakness: TOTP codes can still be phished. A sophisticated attacker can create a fake login page that captures your username, password, and TOTP code in real time and immediately uses them on the real site before the 30-second window expires. This is called a real-time phishing attack.
3. Push Notification Approval (Good, with caveats)
Apps like Duo Security send a push notification to your phone: “Someone is trying to log in from Chicago. Was this you?” You tap Approve or Deny. This is convenient and more secure than SMS, but it has a weakness called MFA fatigue (also called push bombing): attackers send dozens of approval requests hoping you will tap Approve by accident or out of frustration. In 2022, Uber was breached this way — an attacker bombarded an employee with push notifications until the employee approved one.
4. Hardware Security Keys (Very secure)
A hardware key like a YubiKey is a physical device that plugs into USB or taps to NFC. When you log in, the site challenges the key, and the key cryptographically signs the challenge using a private key that never leaves the device. Hardware keys are phishing-resistant — they verify the domain of the site they are responding to, so they will not respond to a fake login page even if you cannot tell the difference.
5. Passkeys (Most secure, newest)
Passkeys are the future of authentication. Instead of a password, your device stores a cryptographic private key. When you log in, the site sends a challenge, your device signs it with the private key, and the site verifies the signature with the corresponding public key. You authenticate to your device using your fingerprint or PIN — that never leaves your device. Passkeys are phishing-resistant (domain-bound), cannot be stolen from a server (only the public key is stored there), and require no password to remember. Google, Apple, Microsoft, and most major sites now support passkeys.
Activity 2 — MFA Scenario Decisions
Apply your knowledge of MFA methods to these real-world situations.
MFA Decision Scenarios
Setting Up MFA — Step by Step
Knowing about MFA is only useful if you actually enable it. Here is how to set up an authenticator app — the best option for most people on most accounts.
Backup codes — do not skip this step
Every MFA setup gives you backup codes — a set of one-time-use codes for emergencies. If you lose your phone, these are the only way to get back into your account. Store them somewhere safe: printed and locked away, in a secure note in your password manager, or written in a notebook kept at home. Never store them in the same place as your password.
Activity 3 — Match MFA Concepts
Match each MFA term or concept to its correct description.
MFA Concepts Matching
Activity 4 — Flashcard Review
Multi-Factor Authentication — Key Terms
Multi-Factor Authentication (MFA) A security system requiring two or more independent proofs of identity from different factor categories. Blocks over 99.9% of automated account compromise attacks.
- Core Concept
- Something You Know
The first authentication factor category — memorised secrets like passwords, PINs, and security question answers. Can be stolen, guessed, or phished.
- Factor
- Something You Have
The second authentication factor category — physical objects like phones, hardware keys, and smart cards. Can be lost or stolen, but much harder to compromise remotely.
- Factor
- Something You Are
The third authentication factor category — biometric characteristics like fingerprints, face scans, and iris scans. Cannot be changed if compromised.
- Factor
- TOTP
Time-based One-Time Password. A 6-digit code generated by an authenticator app that changes every 30 seconds. Not phishing-resistant but immune to SIM swapping.
- Method
- SIM Swapping
An attack where criminals convince your phone carrier to transfer your number to their SIM card, allowing them to receive your SMS MFA codes. Defeats SMS-based MFA.
- Attack
- MFA Fatigue (Push Bombing)
An attack where the attacker sends dozens of push notification approval requests hoping the victim approves one by accident or frustration. Defeated Uber’s security in 2022.
- Attack
- Hardware Security Key
A physical device (e.g. YubiKey) that cryptographically signs login challenges. Phishing-resistant because it verifies the domain before responding. Cannot be SIM-swapped.
- Method
- Passkey
A phishing-resistant authentication method using public-key cryptography. The private key never leaves your device. You authenticate with your fingerprint or PIN. No password needed.
- Method
- Backup Codes
Emergency one-time-use codes provided during MFA setup. Used to regain account access if you lose your MFA device. Must be stored securely — not with your password. Concept
Activity 5 — Real-World MFA Scenarios
MFA decisions come up constantly in real life. Work through these scenarios and choose the best action.
MFA Decision Scenarios
Final Quiz — MFA Mastery Check
Multi-Factor Authentication — Knowledge Check
An attacker has your email password. You have SMS-based MFA enabled. What attack could still allow them to access your account?
- Brute force attack
- SIM swapping
- SQL injection
- Dictionary attack
Answer: SIM swapping
SIM swapping transfers your phone number to the attacker’s SIM card, so they receive your SMS MFA codes. With your password AND your SMS codes, they can log in. This is why authenticator apps and hardware keys are more secure than SMS.
Using two different passwords counts as multi-factor authentication.
- True
- False
Answer: False
MFA requires factors from different categories. Two passwords are both “something you know” — the same category. A true second factor must be “something you have” (phone, hardware key) or “something you are” (biometric). Two passwords provide no additional protection against phishing or breaches.
Why are passkeys considered phishing-resistant?
- They use very long passwords
- The private key never leaves your device and the system verifies the exact domain before authenticating
- They require a hardware key
- They change every 30 seconds like TOTP
Answer: The private key never leaves your device and the system verifies the exact domain before authenticating
Passkeys use public-key cryptography. Your private key never leaves your device. The authentication system cryptographically verifies the exact domain — so a phishing site at “g00gle.com” cannot receive a valid passkey response meant for “google.com”. This makes passkeys immune to real-time phishing attacks that defeat TOTP.
Which of these is the WEAKEST form of MFA?
- Hardware security key (YubiKey)
- Authenticator app TOTP codes
- SMS one-time codes
- Passkey
Answer: SMS one-time codes
SMS codes are the weakest MFA option because they are vulnerable to SIM swapping (attacker transfers your number) and can be intercepted in real-time phishing attacks. They are still much better than no MFA, but authenticator apps, hardware keys, and passkeys are all more secure.
Previous lesson: Password strength and uniqueness
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: Password managers