Multi-Factor Authentication: Examples of Different Factors

Quick Answer

Smart card and PIN is a valid multi-factor combination because it pairs two authentication elements drawn from genuinely different factor categories: the smart card represents something you have, or possession, while the PIN represents something you know, or knowledge. True multi-factor authentication requires combining factors from at least two of the three recognized categories, knowledge, possession, and inherence (something you are), rather than simply requiring two credentials of any kind. This is the detail that trips people up: a combination can look like it involves two things to enter, but if both of those things fall into the same category, it's still only single-factor authentication in terms of actual security value, because compromising one factor in that category doesn't require defeating a fundamentally different type of defense. A hardware token paired with a fingerprint works the same way as smart card and PIN, just using possession and inherence instead of possession and knowledge; a password paired with a one-time passcode from a token similarly combines knowledge and possession. What disqualifies other combinations is pairing two knowledge factors, like two passwords or a password and a PIN, or two inherence factors, like a fingerprint and facial recognition, together, since both members of the pair belong to the same category. When evaluating whether a combination qualifies as MFA, always check that the paired elements come from different categories, not just that there are two of them.