MFA & Authentication Factors Cheat Sheet

Authentication rests on three pillars and is delivered through authenticators that hold credentials. This page is the one-stop reference: define the vocabulary, map every authenticator to its factor, and see at a glance which ones are phishing resistant.

The Cheat Sheet (one glance)

KNOWLEDGE Something you know: password, security-question answer, challenge answer.
POSSESSION Something you have: phone (OTP), authenticator app, security key.
INHERENCE Something you are: fingerprint, face, voice, Windows Hello.

The strongest class is WebAuthn / FIDO: security keys, device biometrics, and passkeys. They combine possession with an optional second factor and are phishing resistant. Passwords, email, and SMS/voice are single-factor and not phishing resistant.

MFA rule: two login steps is not automatically two factors. Phone-unlock-plus-app stays one factor if both live in the same category. True MFA needs two different factor types.

The three layers

> LOGIN CREDENTIALS A set of attributes that uniquely identifies a system user.
> AUTHENTICATORS The entities used to confirm the identity of a user (for example, a password or a security key). Authenticators hold credentials.
> AUTHENTICATION FACTORS The categories that describe an authenticator. Every authenticator has one or more authentication factors. Commonly referred to as factor types.
The chain, memorised once: credentials are held by authenticators; factors describe authenticators; and one authenticator can carry one or more factors. That last clause is why phone-unlock-plus-app is not automatically MFA: two steps in the same factor category is still one factor.

The three factor types

Authenticators, such as a password or SMS notification, are broken into three types, known as authentication factors. Select each tab to see the category and the examples the course files under it.

> KNOWLEDGE = SOMETHING YOU KNOW Knowledge-based authentication is something you know. This may include, but is not limited to:
  • Password
  • Answer to security question
  • Answer to challenge question
> POSSESSION = SOMETHING YOU HAVE Possession-based authentication is something you have. This may include, but is not limited to:
  • Time-based one-time password (OTP) delivered over SMS
  • Authenticator app like Auth0 Guardian or Cisco Duo
  • Security key like a Yubikey
> INHERENCE = SOMETHING YOU ARE Inherence-based authentication is something that you inherently are. This may include, but is not limited to:
  • Fingerprint (Touch ID, Windows Hello)
  • Facial recognition (Face ID, Windows Hello)
  • Voice recognition

Authenticators & their factors

The full comparison, straight from the Auth0 factor table. An asterisk ( * ) marks a factor that is optional on top of the primary one: for example, an authenticator that proves possession but can be unlocked with a passcode (possession + knowledge) or a biometric (possession + inherence).

Authenticator Authentication Factor Characteristics
Auth0 Guardian Possession; Possession + Knowledge *; Possession + Inherence * Device Bound; Hardware Protected. Auth0 Guardian is an iOS/Android mobile app that provides multi-factor authentication (MFA). Users can authenticate via a push notification or a one-time password (OTP) delivered to their registered device. The app supports passcode and biometric configuration for enhanced security.
FIDO Auth with WebAuthn Security Keys Possession; Possession + Knowledge *; Possession + Inherence * Phishing Resistant; Device Bound or Syncable. Follows the FIDO Web Authentication (WebAuthn) standard.
FIDO Auth with WebAuthn Device Biometrics Possession; Possession + Knowledge *; Possession + Inherence * Phishing Resistant; Device Bound. Follows the FIDO Web Authentication (WebAuthn) standard.
Phone Possession SMS and Voice notification factors require a phone to authenticate from a text message or call that contains a code.
Email Notification Knowledge The Email authenticator allows users to authenticate successfully with an OTP or a token (referred to as an Email Magic Link) that is sent to their primary email address.
Passkeys (as a primary authenticator) Possession + Knowledge *; Possession + Inherence * Phishing Resistant; Device Bound or Syncable. Follows the FIDO Web Authentication (WebAuthn) standard.
Password Knowledge The Password authenticator consists of a string of characters that can be specified by users or set by an Admin.

Gotchas worth drilling

  • SMS OTP is Possession. The course files a timed OTP delivered over SMS under something you have (the phone), not something you know.
  • Windows Hello sits under both fingerprint and facial recognition. It is an umbrella authenticator spanning two inherence modalities, which is exactly the "one authenticator, one or more factors" rule in action.
  • A Yubikey splits. As a security key it is textbook Possession; its static-password mode is a knowledge-type credential and is not a valid Auth0 MFA factor.
  • Phishing Resistant is the top-tier signal. Only the WebAuthn/FIDO rows claim it. Security keys, device biometrics, and passkeys cryptographically bind authentication to the site, so a phished credential cannot be replayed elsewhere.
  • Email and Phone are single factor. A magic link or an SMS/voice code proves one property each (knowledge / possession) - they are second-factor delivery, not multi-factor authentication on their own.

Related on this site: Strong Customer Authentication, which legally demands two of these same three categories for EEA payments.