Multi-Factor Authentication
Multi-Factor Authentication (MFA) is an identity verification security mechanism that requires users to provide two or more distinct categories of verification factors when logging in or performing sensitive operations. These factors typically include something the user knows (e.g., a password), something the user possesses (e.g., a hardware token or mobile device), and something inherent to the user (e.g., a fingerprint or facial recognition). By layering multiple verification steps, MFA effectively reduces the risk of unauthorized account access resulting from a single compromised credential.
Timeline (last 90 days)
安全社区长期呼吁「不要将手机号作为唯一验证因素」，多因素认证（MFA）的设计初衷正是避免单一标识符承担过高的安全权重。
The article recommends that small and medium-sized enterprises enable multi-factor authentication for important accounts to address cybersecurity risks.
Even with MFA deployed, defenses can still be breached once a session is hijacked or credentials are stolen along with session tokens.
Adversarial proxy tools (such as Evilginx2 and Modlishka) can relay traffic between users and real websites in real time, stealing session cookies at the moment the user completes MFA verification.
Combining multi-factor authentication, the principle of least privilege, and device health checks can significantly reduce the scope of damage attackers can cause after a vulnerability is exploited.
MFA requires users to provide an additional second verification factor when logging in, such as TOTP, a hardware security key, or biometrics.
Multi-factor authentication (MFA) is one of the most direct and effective technical measures currently available against credential leakage.
Common questionnaire items in the authentication section include whether SSO (Single Sign-On) is supported, whether SCIM user provisioning is supported, and whether multi-factor authentication is enforced.
多因素身份验证（MFA）在认证层面增加第二道防线，即便凭证泄露，攻击者也无法仅凭账号密码完成身份验证
All Facts (9)
安全社区长期呼吁「不要将手机号作为唯一验证因素」，多因素认证（MFA）的设计初衷正是避免单一标识符承担过高的安全权重。
50%UnverifiedThe article recommends that small and medium-sized enterprises enable multi-factor authentication for important accounts to address cybersecurity risks.
50%UnverifiedEven with MFA deployed, defenses can still be breached once a session is hijacked or credentials are stolen along with session tokens.
50%UnverifiedAdversarial proxy tools (such as Evilginx2 and Modlishka) can relay traffic between users and real websites in real time, stealing session cookies at the moment the user completes MFA verification.
50%UnverifiedCombining multi-factor authentication, the principle of least privilege, and device health checks can significantly reduce the scope of damage attackers can cause after a vulnerability is exploited.
50%UnverifiedMFA requires users to provide an additional second verification factor when logging in, such as TOTP, a hardware security key, or biometrics.
50%UnverifiedMulti-factor authentication (MFA) is one of the most direct and effective technical measures currently available against credential leakage.
50%UnverifiedCommon questionnaire items in the authentication section include whether SSO (Single Sign-On) is supported, whether SCIM user provisioning is supported, and whether multi-factor authentication is enforced.
50%Unverified多因素身份验证（MFA）在认证层面增加第二道防线，即便凭证泄露，攻击者也无法仅凭账号密码完成身份验证
50%