Multi-factor authentication: where it is usually missing

A second factor stops most attacks that start with a stolen password. The weakness is usually not the login page. It is everything around it.

Common gaps

• Reset paths: a password reset by email that skips the second factor.
• Old protocols: mail, VPN or API access that accepts a password alone.
• Service and admin accounts: exempted "because they are special".
• Enrolment: a new device can be registered with little verification.
• Recovery codes: stored in the same place as the password.

How a test checks

A tester tries each route to the same account and notes which ones ask for the second factor and which do not. One unprotected route is enough to defeat the rest.

What to do

Apply it consistently, prefer methods that resist phishing where possible, and make the recovery process at least as strict as the login.