MFA, Biometrics & FIDO2/Passkeys

1🔐 Multi-Factor Authentication

Multi-factor authentication requires evidence from more than one factor category (Module 9 hub, Section 3):

Something you know          Something you have
Password                +   Smartphone

Something you have          Something you know
Smart card               +  PIN

The smart card represents possession; the PIN represents knowledge — two independent categories, which is what makes it genuine MFA rather than "two things you know."

Common MFA technologies

2💥 MFA Fatigue, Number Matching, Step-Up & Risk-Based Auth

MFA fatigue attacks

An attacker who already knows a user's password repeatedly triggers authentication. The victim's phone shows Approve login? again and again until they approve one just to stop the notifications — also called push bombing or MFA bombing. Controls include number matching, additional context, risk-based authentication, rate limiting, device binding, and phishing-resistant authentication.

Number matching

Instead of a blind Approve button, the login screen shows a number (Enter 42 in your authenticator app) that the user must type into their device. Blind approval becomes significantly harder because the attacker's spam alone can't trick the user into matching a number they never saw.

Step-up authentication

Not every action deserves the same assurance level. A user might log into banking with password + biometric, then hit step-up authentication specifically when attempting a large transfer:

Common in banking, privileged administration, healthcare, government, payments and other high-value transactions.

Risk-based authentication

Modern identity platforms may evaluate context before deciding whether extra authentication is needed. A user who normally logs in from London on a corporate laptop at 09:00 suddenly logging in from an unknown device, on an anonymous network, at 03:00, from a different country, raises the calculated risk score — which can trigger a block or force stronger MFA. This is central to Zero Trust architectures (Module 8, Section 13).

3👀 Biometrics

Biometric authentication uses measurable physical or behavioural characteristics — fingerprint, facial recognition, iris scanning, voice recognition, palm recognition.

How biometrics work

Fingerprint
     ↓
Sensor
     ↓
Feature extraction
     ↓
Biometric template

During authentication, a new fingerprint is captured, converted into biometric data, and compared against the registered template, producing a match score:

New fingerprint
      ↓
Generate biometric data
      ↓
Compare with registered template
      ↓
Match score

The system decides whether the match score clears an acceptable threshold.

False acceptance and false rejection

Biometric systems are probabilistic, not a simple exact match:

Organisations tune this threshold to balance security against usability — too strict and legitimate users get locked out constantly; too loose and impostors get through.

Biometrics should usually remain local

Modern devices typically keep biometric data on the device rather than transmitting fingerprints or facial images to a remote server:

Application
      ↓
Request biometric verification
      ↓
Device secure hardware
      ↓
Fingerprint/Face verified locally
      ↓
Cryptographic key unlocked

The server receives cryptographic proof, not the user's actual fingerprint. This design is fundamental to modern passwordless authentication, covered next.

4🔑 FIDO2 & Passkeys

FIDO2 (Fast IDentity Online) is one of the most important developments in modern authentication, combining WebAuthn (lets browsers/web apps talk to authenticators) and CTAP (lets devices talk to external authenticators like security keys) to enable strong public-key-based authentication.

Public-key authentication in FIDO2

Traditional passwords use a shared secret the server must store. FIDO2 uses asymmetric cryptography instead — the private key never leaves the authenticator.

Why FIDO2 is phishing-resistant

A fake website can ask Username: / Password: and a victim can accidentally hand both over. FIDO credentials are cryptographically bound to the legitimate service — a credential registered for login.company.com cannot simply be replayed against login-company-security.example. This is what "phishing-resistant" actually means in practice, not just "harder to phish."

Hardware security keys

A physical security key (USB-A, USB-C, NFC, or Bluetooth) can act as a FIDO authenticator:

Administrator
      ↓
Opens cloud admin portal
      ↓
Enters username
      ↓
Security key requested
      ↓
Touches security key
      ↓
Cryptographic authentication
      ↓
Access granted

High-risk organisations commonly issue these to domain admins, cloud admins, security teams, developers, executives, and privileged access workstations.

User presence vs user verification

A FIDO device can therefore require possession of the authenticator plus a PIN or biometric — presence and verification combined.

Passkeys

Passkeys are a modern implementation of FIDO-based passwordless authentication, using public-key cryptography instead of a server-stored password:

Website
   ↓
Passkey request
   ↓
Phone/Laptop
   ↓
Face/Fingerprint/PIN
   ↓
Private key signs challenge
   ↓
Server verifies signature

The user never needs to remember or type a password.

Device-bound vs synced passkeys

Device-bound credentials stay tied to one authenticator or device — strong control, common in enterprise deployments. Synced passkeys are synchronised across a user's trusted ecosystem, improving usability since users don't lose access when replacing a device — the more common consumer approach.

Enterprise challenges with passkeys

Passkeys dramatically improve security, but organisations still have to solve: employee onboarding, lost devices, account recovery, shared workstations, privileged administrator accounts, contractors, cross-platform compatibility, device management, regulatory requirements, and help-desk recovery procedures. Passwordless technology doesn't eliminate identity management — it changes how identity is proved.

Lab📱 Lab 1 – Walk Through an MFA Login

Lab🔑 Lab 2 – Register and Use a Passkey

Lesson Outcome

You should now be able to compare MFA technologies by strength (SMS/email OTP < TOTP/push < FIDO2/passkeys), explain why MFA fatigue defeats simple push approval and how number matching helps, and explain why FIDO2/passkeys are considered phishing-resistant in a way password + OTP never fully is. Lesson 3 moves from "how a human proves who they are" to "how one system lets an application access another system on a user's behalf" — OAuth and OpenID Connect.