Authentication interview question · Most asked
What is multi-factor authentication, and which factors are strongest?
Summary
MFA requires two or more independent factors: something you know (password), have (device, security key) or are (biometric). Phishing-resistant factors like FIDO2/WebAuthn security keys and passkeys are strongest; TOTP apps are good; SMS codes are weakest due to SIM swapping and phishing.
Longer Answer
Push-notification MFA is vulnerable to fatigue attacks (spamming approvals) unless number matching is used. Provide recovery codes and secure account recovery, which is often the weakest link. Step-up authentication requires re-verification for sensitive actions.
Key Points
- Know / have / are
- Passkeys & security keys are phishing-resistant
- SMS is weakest
- Secure recovery flows
- Step-up auth for sensitive actions
More most-asked Authentication questions
- What is the difference between authentication and authorization?
- Compare session-based authentication with token-based (JWT) authentication.
- What are the most common JWT security pitfalls?
- What are OAuth 2.0 and OpenID Connect, and how do they differ?
- Explain the OAuth 2.0 Authorization Code flow with PKCE.
- How do refresh tokens work, and how do you secure them?
- How should passwords be stored?
- How do you secure session cookies?