Experts often hold up multi-factor authentication (MFA) as the gold standard of preventing unauthorized access. While it does provide more security, it’s not enough to protect against phishing and adversary-in-the-middle attacks, a fact that bad actors know and actively exploit. 

Traditional MFA uses phishable factors that often require a second device. For example, common MFA methods include one-time passcode (OTP) or a push notification sent to a user’s phone. From a security perspective, the problem with these factors is that every time something traverses the network it can be phished. Plus, it’s easy to social engineer the end-user into giving up their OTP or accepting a push notification (see push bombing attacks). 

Additionally, traditional MFA frustrates users. They have to stop working to log in using another device and sometimes they don’t have access to that second device on hand. Pushing users out of the context of their work creates friction that erodes productivity. Because the process is inconvenient and full of friction, users sometimes create their own shortcuts and workarounds, which often open up even more security gaps.

Organizations put multi-device MFA into practice to increase security, but often the result is the opposite – breaches, data loss and fraud, resulting in increased costs and complications. Just ask Uber, which was hacked after a push fatigue attack to a contractor’s device. 

To overcome these issues with traditional MFA, organizations are increasingly turning to single-device phishing-resistant MFA. With this approach, all the authentication happens on the device the user is currently using to gain access, which is more secure and seamless.

Three key components of single-device MFA

By eliminating phishable factors, single-device MFA increases both security and usability. Single device phishing-resistant MFA:

• Eliminates passwords – While passwords have been the cornerstone of authentication for decades, they are a top cause of cyberattacks. Additionally, IT staff spend significant time doing resets due to users forgetting their passwords. By going passwordless authentication is more secure and user friendly.
• Binds the identity to the device – Instead of a risky code or link, single-device MFA securely uses asymmetric keys with a private key that is created and stored in the hardware component of the device. Given that the key can’t move or be shared, companies can have cryptographic assurance that it’s the right user on the right device gaining access.  
• Using biometrics – Because biometrics are unique to each user, methods such as fingerprint and facial recognition provide a high level of security during the authentication process. Biometrics provide a seamless experience that is a cornerstone of phishing-resistant and single-device MFA.

Increasing security and improving the user experience

Single-device MFA provides many benefits in terms of both security and usability:

• Frictionless experience – Instead of breaking their workflow, the user gets access without interruption. With a streamlined authentication, users do not need a second device. Because the process eliminates the interruption to workflow that happens with traditional MFA, users see an increase in productivity.
• No need for a second device – In addition to eliminating the time and frustration of using a second device, single-device MFA can also reduce costs. A recent ruling in California makes the employer financially responsible for devices used for work. When employees are required to use their personal devices for authentication, which often is the case with traditional MFA, they are officially using their cell phone for business. By using single-device MFA, organizations eliminate this extra expense and the possible financial consequences.
• Phishing-resistant MFA – Each time an authentication process sends a one-time password or a magic link, it creates the opportunity for phishing. By eliminating the authentication being sent to a second device, single-device MFA minimizes the risk of phishing.
• Meeting government and regulatory mandates – The US government has a mandate to move to phishing-resistant MFA by the end of 2024. Additionally, for organizations purchasing cybersecurity insurance, phishing-resistant MFA is increasingly becoming a requirement.

Moving forward with single-device MFA

Your organization must keep its data and infrastructure secure from attacks while at the same time making it easy for employees to be as productive as possible. By partnering with Beyond Identity, your organization can solve its most pressing security and user experience needs.

With Beyond Identity’s single-device MFA, your organization uses a phishing-resistant process that relies on local biometrics, cryptographic security keys, and device-level security checks to make sure that only authorized users can gain access. Beyond Identity’s single-device MFA gives your organization the seamless processes you need to both delight your users and reduce risks.

Get a demo of how Beyond Identity and see how your authentication can be frictionless and secure.