Abstract or Summary:
Multi-factor (or Two-factor) Authentication (MFA or 2FA) is widely recommended to people as a measure they should adopt to improve their security, and many explicitly security conscious individuals have come to demand it of various services. The security properties we may wish from authentication are complicated and subtle, and MFA's contribution to those properties is also far from simple or obvious. It is therefore to be expected that most users' understanding of MFA will contain errors, some of which may be dangerous.

We discuss the security properties of MFA, the security expectations of MFA, and the causes for some of the mismatches between them.

PasswordResearch.com Note: Video of presentation: https://www.youtube.com/watch?v=vGTzuOJHcUE