What is Two-Factor Authentication (2FA)?

Two-factor authentication, or two-step verification, is a security measure that requires two distinct forms of identification (aka factors) before granting access to a system or service. The second authentication factor adds another layer of protection, making it more challenging to gain unauthorized access.

Traditionally, user authentication requires only an email address or username and password. Although this involves a combination of login credentials, it’s still technically just one authentication factor.

Plus, without strong password hygiene, it’s much too easy for cyber threats to bypass security and compromise an online account, application, or resource. If they do, there’s no telling how much sensitive information they could harvest.

In short, that’s why 2FA has risen to prominence. Not only does it mitigate the risk of a data breach, but it also protects employees and consumers from identity theft and other threats.

2FA authentication factors

An authentication factor is a unique identifier associated with a specific user. Most 2FA systems leverage two out of three traditional authentication factors:

• Knowledge factor: Something only the user would know, such as a password, PIN, or the answer to a security question.
• Possession factor: Something only the user would have, such as a security key, mobile device, or ID card.
• Inherence factor: Something only the user could be. As a form of biometric authentication, it uses facial recognition, fingerprints, and iris scanning to verify identity.

In addition to those above, many of today’s cutting-edge solutions are leveraging two new adaptive authentication factors:

• Behavior: This analyzes digital artifacts related to behavioral patterns. For example, 2FA systems may consider an attempted login suspicious if it comes from a new mobile phone rather than the user’s trusted device.
• Location: This factor considers geography for user authentication, analyzing IP address and GPS location.

Typically, organizations can configure 2FA systems to require a combination of the above factors. Users must correctly submit the requested information, whether actively or passively, to access their online account, service, or system.

2FA vs. MFA

Why stop at two factors when you can theoretically aggregate any number of authenticators? In short, that’s the idea behind multi-factor authentication (MFA). 

MFA is an extension of 2FA, involving two or more authentication factors. Simply put, the latter is a subset of the former.

One critical difference between the two is that MFA can be more adaptive. In other words, it can dynamically enforce step-up verification, challenging users to provide a third authentication factor based on context.

Although 2FA can be an effective security measure, MFA is often a more comprehensive solution. That’s why, according to a survey of IT professionals, 83% of companies require employees to use MFA to access all corporate resources.

Use cases

Two-factor authentication is the most ubiquitous form of MFA, which makes it a perfect fit for use cases where various people need access to data. For instance, healthcare applications commonly use 2FA because it enables physicians and other clinicians to access sensitive patient data on demand — often from personal devices. 

Other notable industry applications include:

• Finance: Banks and other financial institutions use 2FA to protect against identity theft and fraud, enabling customers to access their online accounts for secure mobile banking.
• Government: In the United States, 2FA is mandated for all federal websites, ensuring sensitive information and citizen data stay under lock and key.
• Higher education: Universities rely on 2FA to secure student portals where grades, schedules, and personal information are stored.
• Social media: Platforms like Facebook and X (formerly Twitter) offer 2FA services to safeguard personal information and enhance account security.

The 2FA process is simple. The specifics may differ depending on the authentication method, but the basic workflow is as follows:

• User login: The user enters their username and password.
• Authentication request: If the primary login is successful, the system triggers a second authentication factor.
• Factor verification: The user provides the second factor, such as a one-time token or passcode generated by an authenticator app.
• Access granted: If both factors are verified, the user gains access to the system. Typically, this happens in seconds with practically zero impact on the user experience.

Two-factor authentication methods

There are several ways a 2FA system can request authentication factors. Each one has its ups and downs, but all are a step toward greater account security.

Let’s take a look at the most common authentication methods, how they work, and the value they bring to the table:

Email and SMS authentication

This method sends the user a one-time passcode (OTP) to their email inbox or as a text message to their mobile phone. In short, an OTP is a 5- to 10-digit verification code that grants access to the requested resource when input correctly.

SMS authentication is one of the most convenient and user-friendly solutions. And, given the availability of mobile devices, it’s easy for users to get started.

However, it’s also vulnerable to cyber threats. Hackers can easily intercept SMS messages, which often aren’t encrypted. Plus, if an attacker gains physical access to the victim’s mobile phone, they can read OTPs directly.

Hardware token

A hardware token is a physical device, like a security key, smart card, or USB dongle. This dynamically generates a unique token, which is usually only valid for a limited time.

During login, the user presses a button on the token, which uses an algorithm to create an OTP. The user enters this verification code into the authentication prompt on their device or application. The server, using the same algorithm and security key, generates its own OTP and compares it with the one entered by the user. If they match, the user is authenticated and granted access. This process ensures that even if a password is compromised, unauthorized access is prevented without the physical token.

However, the obvious downside is that hardware token authentication isn’t always practical or applicable to all use cases. It can be costly to set up and maintain, plus devices may be misplaced or stolen.

Software token

A software token is a time- or event-based OTP sent through an authenticator app on the user’s computer or mobile phone. Like a hardware token, this method dynamically generates a verification code that lasts just a brief period of time.

Overall, it’s a user-friendly and simple process, but it does require the user to download additional software to their devices.

Push notification

A push notification verifies the user’s identity by sending an alert directly to a secure mobile app on their trusted device. This message contains details about the authentication attempt, allowing the user to approve or deny the access request with a single tap.

In theory, this process confirms that the device registered to the authentication app is in the user’s possession. Push notifications eliminate the risk of man-in-the-middle attacks, ensuring their account is safe. This method of 2FA is highly secure, but it depends on internet connectivity.

Biometric authentication

Lastly, there are various forms of passwordless authentication — most notably, biometrics. In basic terms, biometric authentication verifies identity using biological traits.

For example, iPhone users are familiar with facial recognition, which can be used to access Apple ID account information, among other services. Other systems use fingerprint, iris, or retinal scanning.

In turn, this is undeniably one of the most secure 2FA options available. Not only does it leverage the user as a token, but it’s also highly convenient and nearly impossible to crack.

Simply put, 2FA is a major step up from the status quo. Password-based security is no longer enough to keep accounts, websites, and services safe from unauthorized access.

Consider a few startling statistics:

• Over 24 billion username and password combinations are circulating the dark web. That number increased by 65% between 2020 and 2022 and is only likely to keep growing. Given that most people reuse old passwords, a single data breach could compromise multiple accounts simultaneously.
• Google’s 2023 Threat Horizons Report found that 86% of breaches involved stolen credentials. In other words, they’re almost always the root cause of much bigger, devastating cyber threats.
• Verizon’s 2024 Data Breach Investigations Report concluded that the “human element” — like weak passwords — led to 68% of reported breaches.

Worse yet, even with strong password hygiene, it doesn’t take much to crack into an account. For instance, hackers can easily browse social media to find the personal information required to answer a basic security question.

Here’s the good news: 2FA and MFA can help. In fact, they effectively mitigate a number of cyber threats, including:

• Stolen passwords: As mentioned above, poor password hygiene makes it easy to steal credentials. 2FA ensures that a stolen password is not all that’s needed to breach an account.
• Brute-force attacks: Hackers use increasingly accessible computing power to randomly generate passwords until they crack the code. But computing power can’t hack a second factor.
• Phishing: 2FA protects against unauthorized access if a username and password are stolen via a phishing attack.
• Social engineering: Clever hackers increasingly use social media to launch attacks that trick users into willingly giving up their credentials. But without the second factor, this effort is futile.

2FA and Zero Trust

Critically, strong authentication is a major part of identity and access management (IAM) — and in turn, Zero Trust architecture. 2FA can help enterprises implement Zero Trust by rigorously enforcing identity verification, basing access decisions not just on user role or permissions, but on device, behavior, location, and more.

Considering two-factor authentication? Here are some key steps to keep in mind:

1. Choose the right authentication factors

Even within each type of authenticator, there are many different options to choose from — and new technologies coming out constantly. How do you choose which factors to use for your 2FA protocol?

Here are a few questions to help you consider the right choice:

• Do you want authentication to be transparent to the user?
• Would you like the user to carry a physical device or authenticate online?
• Do you want the website to authenticate itself to the user as well?
• How sensitive is the information you are protecting and what is the associated risk?
• Is physical access (link) to offices, labs, or other areas part of your user requirement?

At Entrust, we support the widest range of 2FA security authenticators, allowing you to choose the best option to fit your security needs and use cases. More importantly, Entrust can provide expert, consultative guidance to help you select the right option(s) and simplify your shift to high-assurance, two-factor authentication.

2. Strategize the user experience (UX)

Although 2FA is generally a seamless workflow, the last thing you want is to burden your users with inconvenient extra steps. User experience is especially important for digital onboarding, as a cumbersome process can drive customers away from account opening.

Look for a 2FA solution that balances security, speed, and UX.

3. Protect your 2FA infrastructure

Ensure that communications involving the transmission of 2FA codes or tokens are encrypted using secure encryption protocols, like Transport Layer Security.

4. Consider adaptive authentication

Depending on the use case, you may need a more robust, multi-factor solution. Adaptive authentication, or risk-based step-up verification, is a dynamic way to confirm identity. As a context-aware method, it adjusts the level and type of authentication required based on perceived risk.

For example, adaptive MFA may only require a username and password if all conditions appear normal. But, if the login comes from an abnormal IP address, it can issue step-up challenges, like a one-time verification code. It balances security with convenience, allowing legitimate users to access resources with minimal friction while enforcing stricter measures for suspicious activities.

Entrust Identity, our unified IAM portfolio can provide the foundation your organization needs to achieve an effective Zero Trust architecture. With our suite of security tools, you can leverage:

• Identity as a Service: Cloud-based IAM solutions with phishing-resistant MFA, passwordless authentication, and single sign-on (SSO).
• Identity Enterprise: On-premise IAM capabilities with high-assurance workforce and consumer authentication, including smart card issuance.
• Identity Essentials: Fast, cost effective multi-factor authentication (MFA) solution that lets Windows-based organizations realize a Zero Trust approach.