2.1.3. Authentication Methods: MFA and Passwordless

💡 First Principle: A password proves you know a secret; it doesn't prove you're the right person, because secrets can be phished, guessed, or reused. Every authentication method beyond a password exists to add or replace that proof with something harder to steal at scale.

Multifactor authentication combines something you know (password) with something you have (a device, a token) or something you are (biometrics). Passwordless methods go further and remove the phishable password entirely — Windows Hello for Business (biometric or PIN tied to a specific device), FIDO2 security keys, and the Microsoft Authenticator app in passwordless mode all authenticate using cryptographic keys that never leave the device, making them resistant to phishing in a way that MFA-with-a-password-first is not.

⚠️ Exam Trap: "Multifactor" doesn't automatically mean "phishing-resistant." SMS and voice-call MFA satisfy the letter of "two factors" but remain vulnerable to real-time phishing proxies and SIM-swap attacks. When a scenario emphasizes resistance to phishing specifically, the correct answer is usually a passwordless, certificate- or key-based method, not just "enable MFA."

Reflection Question: Why does authentication strength (a Conditional Access concept) matter more than simply "is MFA enabled" when defending against a sophisticated phishing campaign?