The MFA Trinity: Something You Know, Are, and Have
A deep dive into why passwords aren't enough and how the holy trinity of authentication protects your digital identity.
2025-10-27
Loading content...
A deep dive into why passwords aren't enough and how the holy trinity of authentication protects your digital identity.
Passwords are a single point of failure and SMS-based 2FA is vulnerable to SIM swapping, making traditional security measures inadequate for valuable digital lives. True security relies on the "MFA Trinity"—combining knowledge, biometrics, and physical possession—a standard that Passkeys elegantly implement by merging the device you have with the biometric you are.
Passwords are, to put it bluntly, a single point of failure.
In an ideal world, we'd all have unique, 100-character passwords memorized for every single service we use. In reality, 62% of people reuse the same password across multiple accounts. That means if a random forum you signed up for in 2018 gets breached, the roadmap to your bank account might just have been published on the dark web.
This is where the concept of identity verification needs to evolve from a simple secret handshake to a robust, multi-layered defense.
Most of us have taken the first step: Two-Factor Authentication (2FA). You log in, and you get a text message (SMS) or an email with a code.
Is this better than just a password. Absolutely. Is it secure. Not really.
SMS protocols are notoriously ancient and vulnerable to SIM swapping: an attack where a bad actor convinces your mobile carrier to port your phone number to their SIM card. Once they have your number, they have your codes. It's a low-tech attack with high-impact consequences.
True, robust Multi-Factor Authentication isn't just about more steps; it's about different types of evidence. We call this the MFA Trinity. To prove you are who you say you are, you should ideally provide evidence from at least two of these three distinct buckets:
This is the legacy layer. It's the secret inside your head.
This is the biometric layer. It proves identity based on inherent physical traits.
This is the physical layer. It requires possession of a specific, tangible object.
A common pushback I hear is, "Why do I need all this for a new account. There's nothing in it."
And you're right. When you create a fresh account, it's like buying an empty house. If someone breaks in, they might steal... the air. The risk is low because the value is low.
But digital accounts obey the law of entropy: they accumulate value over time.
As the value of the asset (your account) increases, the cost of protecting it must strictly increase. You don't put a bank vault door on a garden shed, but you also don't put a screen door on a bank vault.
The industry is rapidly convergent on Passkeys as the implementation of this trinity. A Passkey effectively combines "Something you have" (your phone/laptop) with "Something you are" (the FaceID/TouchID required to unlock it), completely removing "Something you know" (the weak password) from the equation.
If you haven't started migrating your critical accounts (Email, Banking, Cloud Storage) to hardware-backed MFA or Passkeys, today is the day. Don't wait until the house is full to buy the lock.