SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/tech-mfa-distinct-factors

What makes authentication truly multi-factor?

It proves control of two distinct factor types.

Start playing free

  1. A password plus a security question
  2. Two distinct authentication factors ✔
  3. One password entered twice

Why: Real MFA combines different kinds of proof, such as something you know with something you have. Two passwords are two steps, but they remain one factor type.

Huh, didn't know that: NIST does not recognize a biometric as an authenticator by itself; it must be paired with a physical authenticator.

The dad joke
Two passwords walked into a login, but MFA said they looked related.
Like this card?
Play the game

References

Answer: Two distinct authentication factors. Real MFA combines different kinds of proof, such as something you know with something you have. Two passwords are two steps, but they remain one factor type.

  1. NIST SP 800-63B Authentication Assurance Levels pages.nist.gov/800-63-4/sp800-63b/aal
    Proof of possession and control of two distinct authentication factors through the use of secure authentication protocols is required.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich password property most directly increases resistance to guessing?Security & PrivacyWhich three goals form the CIA triad?Security & PrivacyWhat does current NIST guidance say about password composition rules?

That's stuff everyone should know.