Cybersecurity Foundations (Grades 9–12) · lesson 7 of 7 · 12 min
Multi-factor authentication in depth You already know MFA requires two or more factors. This lesson covers the implementation details that matter for security engineers. TOTP — Time-based One-Time Passwords TOTP (RFC 6238) generates a 6-digit code that changes every 30 seconds. It is computed from a shared secret and the current Unix timestamp. Authenticator apps (Google Authenticator, Authy) implement TOTP. The server and app must have synchronized clocks — most implementations allow a ±1 window (90 seconds) to account for drift. FIDO2 / WebAuthn / Passkeys FIDO2 is a phishing-resistant authentication standard. Instead of a shared secret, it uses public-key cryptography. Your device holds a private key; the server stores the public key. When you authenticate, your device signs a challenge with the private key — the server verifies with the public key. The private key never leaves your device, so it cannot be phished. Passkeys are the consumer-friendly implementation of FIDO2, supported by Apple, Google, and Microsoft. They replace passwords entirely. Adaptive MFA Adaptive (risk-based) MFA only prompts for a second factor when risk signals are elevated — new device, unusual location, sensitive action. This balances security with user experience.
Match the MFA technology
Previous lesson: Password hashing and storage
Back to Cybersecurity Foundations (Grades 9–12)