Passwords Are Dead: Why I Demand MFA on Every Session

Should I really bother with another authentication factor?

If you've ever typed a password and thought, "That's enough," I'm here to tell you: you're wrong. I'm not talking about adding complexity for its own sake. I'm talking about the single most important change you can make to your access control strategy. The answer to the question above is a resounding yes, and here's why I've made MFA my hill to die on.

My Thesis: MFA Is Non-Negotiable

Here's my position, stated plainly: any system that relies on a single authentication factor is fundamentally broken. I don't care if it's a lab environment or a production server. If you're letting someone in with just a password, you're asking for trouble. The NIST Digital Identity Guidelines (NIST SP 800-63B) are clear: multi-factor authentication requires the claimant to prove possession and control of two or more distinct authentication factors. And NIST recommends AAL2—which mandates MFA—for most systems handling personal, financial, or operational data. That's not a suggestion; it's a baseline. I'm not saying you need to go full AAL3 with hardware tokens for everything—that's overkill for your marketing blog. But AAL2 should be your floor.

The Password Fallacy: Why 'Something You Know' Isn't Enough

Let's talk about passwords. NIST SP 800-63B requires subscriber-chosen passwords to be at least 8 characters long and recommends permitting passwords of at least 64 characters. But even a 64-character password is just one factor. It's something you know, and it can be phished, stolen, or guessed. The fact that NIST also recommends allowing long passwords doesn't change the fact that they're still just passwords. I've seen too many breaches where a single compromised password led to total system compromise. The 'something you have' factor—like a one-time password device—adds a layer that a remote attacker can't easily replicate. And 'something you are'—biometrics—adds yet another. But the point is, you need at least two distinct types.

But What About Single Sign-On? Isn't That Enough?

You might be thinking, "I use SSO, so I'm fine." Let me address that. Single sign-on (SSO) is great—it lets a user authenticate once and gain access to multiple applications with a single set of credentials, relying on a trusted identity provider (CISA SSO). It reduces password fatigue and password reuse, which is a huge win. But here's the catch: SSO is not an authentication factor. It's a convenience layer. If your SSO is protected by only a password, you've just concentrated your risk. One password, many applications. That's a single point of failure. The CISA guidance on SSO adoption for SMBs points out the benefits, but it doesn't say to skip MFA. In fact, the federal government's zero trust strategy (OMB M-22-09) specifically required agencies to achieve phishing-resistant multi-factor authentication by the end of fiscal year 2024. They didn't say "use SSO and call it a day." They said MFA, and specifically phishing-resistant MFA.

The Zero Trust Reality: No Implicit Trust

Now, let's zoom out. The whole point of authentication is to establish trust. But the zero trust model (NIST SP 800-207) tells us to grant no implicit trust to assets or user accounts based solely on their physical or network location. That means even if you're on the corporate network, you don't get a free pass. Access is granted on a per-session basis, determined by dynamic policy considering the state of the user, device, and environment. That's a tall order for a password alone. MFA is a critical part of that dynamic policy. It's not just about the factor itself; it's about the context. A password doesn't tell you if the user is on a compromised device. An MFA prompt, especially a phishing-resistant one, gives you a much stronger signal.

But What About Usability? Won't MFA Slow Things Down?

I hear the counter-argument: "MFA is a pain. It slows down users." I get it. Nobody likes typing a code from an authenticator app every time they log in. But here's the thing: the cost of a breach is far higher than the cost of a few extra seconds. And modern MFA doesn't have to be clunky. You can use hardware tokens, push notifications, or even biometrics. The NIST AAL2 requirement for two different factors doesn't mean you need to make life miserable. You can implement adaptive MFA that only triggers when risk is high. But the baseline should be there. The alternative—relying on passwords alone—is like leaving your front door unlocked because the lock is annoying to use.

The Bottom Line: MFA Is the Price of Admission

If there's one thing I want you to remember, it's this: MFA is not optional; it's the bare minimum for any serious access control. I don't care how strong your passwords are, how long your SSO session lasts, or how many layers of RBAC you have. If you're not requiring at least two distinct authentication factors, you're not doing authentication right. Start with AAL2, and if you handle sensitive data, push toward AAL3. The days of passwords alone are over. I'm not saying it's easy, but it's necessary. And it's the difference between being a victim and being a survivor.

Sources

• NIST SP 800-63B - https://pages.nist.gov/800-63-3/sp800-63b.html
• OMB M-22-09 - https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf
• CISA SSO - https://www.cisa.gov/sites/default/files/2024-06/Barriers-to-SSO-Adoption-for-SMB-508c.pdf
• NIST SP 800-207 - https://csrc.nist.gov/pubs/sp/800/207/final