MFA for All
summary
Argues for rolling out MFA by turning strong methods default on, offering an authenticator of choice catalog and enrolling users by cohort segmentation. Implements an A1/A2 matrix with two trust thresholds (high vs. medium), lets any remaining authenticator satisfy A2 if A1 is high, otherwise forces a high A2, and retires compromised methods. Targets roughly 90–95% adoption, uses risk-based step‑ups for sensitive transactions, ranks biometrics high and SMS/OTP lower, and flags social engineering and first‑party fraud as the main remaining threats.
AI-written summary · about
chapters (13)
- 0:00Introduction to MFA
- 2:06Authentication purpose and UX
- 3:10Default on strong security
- 4:38Authenticator of choice explained
- 6:23Multi-factor authentication basics
- 9:32Ranking authentication methods
- 12:38Trust thresholds for authenticators
- 15:10Applying trust thresholds
- 16:37Risk-based authentication
- 18:46Cohort segmentation strategy
- 21:55Adoption goals and challenges
- 23:01Post-MFA fraud risks
- 25:11Closing remarks
related talks
38mAnatomy of the Attack: The Rise and Fall of MFA
20mBuilding a Resilient MFA Framework: Strategies and Best Practices
13m"As soon as it's a risk, I want to require MFA": How Administrators Configure...
17mImplementing Multi-factor Authentication
50mOne Does Not Simply Add MFA
45mMFA: Stories that make you go 'Huh?'
34mWhat does ”MFA” mean?
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up