{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/two-factor-authentication","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/two-factor-authentication/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/two-factor-authentication/"},"term":{"en":"Two-factor authentication","da":"To-faktorautentificering"},"aka":{"en":["2FA","two-step verification"],"da":["2FA","tofaktorgodkendelse","totrinsbekræftelse"]},"domain":["security"],"cluster":"controls","layer":"identity","status":"current","era":2011,"summary":{"en":"The most common form of MFA, where logging in needs exactly two separate proofs, usually a password and a one-time code.","da":"Den mest udbredte form for MFA, hvor et login kræver præcis to uafhængige beviser, typisk en adgangskode og en engangskode."},"body":{"formal":{"en":"A form of multi-factor authentication limited to exactly two factors from different categories, most often a password combined with a code or approval from a device the user holds.","da":"En form for multifaktorgodkendelse begrænset til præcis to faktorer fra forskellige kategorier, oftest en adgangskode kombineret med en kode eller godkendelse fra en enhed, brugeren har."},"plain":{"en":"Like a door with two different locks - one opened by what you remember, one by what is in your pocket.","da":"Som en dør med to forskellige låse - den ene åbnes med noget, du husker, den anden med noget, du har i lommen."},"inPractice":{"en":"An adviser at a pension fund working from home logs in to her work computer remotely with her password, then types the short code a code app on her phone shows before the session opens.","da":"En rådgiver i en pensionskasse, der arbejder hjemmefra, logger ind på sin arbejdscomputer med sin adgangskode og taster derefter den korte kode, som en kode-app på hendes telefon viser, før sessionen åbner."},"whyItMatters":{"en":"It is the step most services actually offer, so it is where most people first get protection beyond a password - but two proofs of the same kind, like two passwords, do not count.","da":"Det er det trin, de fleste tjenester faktisk tilbyder, så det er her, de fleste først får beskyttelse ud over en adgangskode - men to beviser af samme slags, fx to adgangskoder, tæller ikke."}},"deepDive":{"en":"Two-factor authentication is MFA with exactly two factors, and in practice almost always a memorised secret plus a possession factor. The terms \"2FA\" and \"two-step verification\" (the name Google used when it opened the feature to all accounts in 2011) are often used interchangeably, but they are not strictly equivalent: two steps are not two factors if both are the same category, and a code sent to an email inbox reachable with the same password adds a step without adding an independent factor. Standards avoid the loose terms. NIST SP 800-63B speaks of multi-factor authentication at AAL2, and the PSD2 strong customer authentication rules require two independent elements from different categories.\n\nThe common second factors differ sharply in strength. SMS and voice codes depend on the phone network and are exposed to SIM-swap fraud, number porting and SS7 interception; NIST classes them as restricted. TOTP apps (RFC 6238) remove the network dependency but still produce a code a human can be tricked into typing on a phishing page. Push approvals are convenient but invite prompt bombing unless number matching is enforced. A FIDO U2F or FIDO2 security key used as the second factor after a password is phishing-resistant, because the signed response is bound to the site's origin. A passkey with user verification (a PIN or biometric on the device) is itself two factors in one step, which is why passkey-based login is often described as replacing, rather than adding to, the password-plus-code pattern.\n\nThe weakest link is usually not the primary second factor but the fallback. Services that offer SMS as a backup to a security key, account recovery by email, or a help-desk reset based on knowledge questions reduce the effective strength to that of the weakest enabled path; attackers target those paths precisely because the main factor is strong. Recovery codes - a short list of single-use secrets issued at enrolment - are a better fallback if stored offline.\n\n2FA also does not protect what happens after login. Session cookies and refresh tokens captured by adversary-in-the-middle proxies, malware stealing browser cookies, and legacy protocols that accept only a password all sidestep the second factor. Organisations therefore enforce 2FA through central policy (conditional access in the identity provider) rather than per-application opt-in, disable legacy authentication, and monitor for new device registrations, which are a typical persistence step after an account takeover. In Denmark, MitID (for citizens) and MitID Erhverv (for organisations) provide the national multi-factor login, based on a user ID and an authenticator such as the MitID app, a code display, a code reader or a MitID chip.","da":"Tofaktorautentificering er MFA med præcis to faktorer, i praksis næsten altid en memoreret hemmelighed plus en besiddelsesfaktor. Betegnelserne \"2FA\" og \"totrinsbekræftelse\" (Googles navn, da funktionen blev åbnet for alle konti i 2011) bruges ofte i flæng, men er ikke helt ens: to trin er ikke to faktorer, hvis begge tilhører samme kategori, og en kode sendt til en mailboks, der kan nås med den samme adgangskode, tilføjer et trin uden at tilføje en uafhængig faktor. Standarderne undgår de løse begreber. NIST SP 800-63B taler om multifaktorautentificering på AAL2, og PSD2-reglerne om stærk kundeautentifikation kræver to uafhængige elementer fra forskellige kategorier.\n\nDe udbredte andenfaktorer er meget forskellige i styrke. Sms- og opkaldskoder afhænger af telefonnettet og er udsat for SIM-swap-svindel, nummerflytning og SS7-aflytning; NIST klassificerer dem som \"restricted\". TOTP-apps (RFC 6238) fjerner afhængigheden af telefonnettet, men giver stadig en kode, som et menneske kan lokkes til at taste ind på en phishingside. Push-godkendelser er bekvemme, men inviterer til prompt bombing, medmindre number matching håndhæves. En FIDO U2F- eller FIDO2-sikkerhedsnøgle brugt som anden faktor efter adgangskoden er phishing-resistent, fordi det signerede svar er bundet til sitets origin. En passkey med brugerverifikation (pinkode eller biometri på enheden) er i sig selv to faktorer i ét trin, og derfor beskrives login med passkeys ofte som en erstatning for mønstret adgangskode-plus-kode snarere end en tilføjelse til det.\n\nDet svageste led er som regel ikke den primære andenfaktor, men reservevejen. Tjenester, der tilbyder sms som backup til en sikkerhedsnøgle, kontogendannelse via mail eller nulstilling hos servicedesken på baggrund af kontrolspørgsmål, reducerer den reelle styrke til den svageste aktiverede vej; angribere går efter netop de veje, fordi hovedfaktoren er stærk. Gendannelseskoder - en kort liste af engangshemmeligheder udstedt ved tilmelding - er en bedre reserve, hvis de opbevares offline.\n\n2FA beskytter heller ikke det, der sker efter login. Sessionscookies og refresh tokens opsnappet af adversary-in-the-middle-proxyer, malware der stjæler browsercookies, og ældre protokoller, der kun kræver adgangskode, omgår alle den anden faktor. Organisationer håndhæver derfor 2FA via central politik (betinget adgang i identitetsudbyderen) frem for frivilligt tilvalg pr. applikation, slår ældre autentificering fra og overvåger registrering af nye enheder, som er et typisk persistenstrin efter en kontoovertagelse. I Danmark leverer MitID (til borgere) og MitID Erhverv (til virksomheder og organisationer) det nationale multifaktorlogin, baseret på et bruger-ID og et identifikationsmiddel som MitID-appen, en kodeviser, en kodelæser eller en MitID-chip."},"edges":[{"type":"requires","to":"cs/password","confidence":"high","strength":"normal"},{"type":"requires","to":"security/authentication-factor","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/mfa","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/phishing","why":{"en":"A captured password alone is not enough to log in, though a fake site that also asks for the code can still defeat it.","da":"En opsnappet adgangskode alene er ikke nok til at logge ind, men en falsk side, der også beder om koden, kan stadig omgå det."},"confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-63B - Digital Identity Guidelines, Authentication","tier":"standard","publisher":"NIST"}],"draft":true}