Specifically, multi-factor authentication is the use of different methods (what you know, what you have, what you are) for a particular session, but in reality, strong authentication deployments often involve a mix and match of authentication methods. Here are some common examples:
For passwordless access, services like eBay and Yahoo can be configured to be approved with a simple touch of the checkbox on their mobile apps (what you have). With their platform services, Microsoft takes a little different approach to passwordless when used with their Authenticator app:
Verified device â€“ Touch finger ID (what you are) to get into Authenticator app then approve access (what you have) .
New device â€“ Touch finger ID (what you are) to get into Authenticator app; choose the option with the correct number displayed on the Microsoft service (what you have â€“ mobile device and in this case itâ€s also the browser instance (usually desktop) accessing service, then approve access (what you have â€“ mobile device).
While these options offer greater protection against phishing attacks, they vary in speed and simplicity (number of steps). Based on their assessed risk and their tolerance for it, each organization can decide how many points of identity verification they want to implement. All the above options have the advantage over passwords in that they donâ€t require the user to remember yet another set of credentials, were a commonly replicated over the difference services the user consumes, are much harder to compromise then traditional username and password. The phone is a physical device, the fingerprint is biometric, and the OTPs are time sensitive. NetIQ Advanced Authentication supports the use cases above and much more.