Back to roadmap
Module 9 · Protocols, Security, ObservabilityDay 08425 min

Authentication: Passwords and MFA

Hash with a slow function; add a second factor.

← PreviousNext →
Day 084

Authentication: Passwords and MFA

User
client
Password (KDF)
service
MFA
service
Session
datastore
Signal path
Auth pipeline
User
client
flow
Password (KDF)
service
Password (KDF)
service
flow
MFA
service
MFA
service
flow
Session
datastore
Memory hook

Authentication: Passwords and MFA: hash with a slow function

Mental model

design for the day something breaks

Design lens

MFA increases friction — adopt risk-based prompts.

Recall anchors
PasswordsMFARecovery

Why it matters

Authenticate users with strong password hashing (slow KDF), and add a second factor wherever risk warrants. Weak recovery flows undo strong front-door auth.

Deep dive

Argon2id is the modern default. Bcrypt remains acceptable.

TOTP is broadly supported; WebAuthn (passkeys) is phishing-resistant and growing fast.

Recovery: device backup codes, secondary email; avoid security questions.

Demo / scenario

Add MFA to existing app.

  1. Allow TOTP enrollment.
  2. Encourage WebAuthn for high-risk accounts.
  3. Backup codes for recovery.
  4. Force MFA challenge on new device/risk events.

Tradeoffs

  • MFA increases friction — adopt risk-based prompts.
  • Recovery channels are the new attack surface.
  • Passkeys remove passwords entirely — strong long-term direction.

Diagram

User
Password (KDF)
MFA
Session
Auth pipeline.

Mind map

Check yourself

Loading quiz…

Sources & further reading

← PreviousNext →