FlowGround
Back to Business Mode

Multi-Factor Authentication

MFA is the single highest-leverage control against account takeover because it breaks the assumption that a password equals identity.

A correct password only satisfies factor one of two required factors
The second factor lives on a separate device the attacker almost never controls
Even a fully phished password is useless without the live OTP/push approval
MFA should be enforced adaptively — more aggressively for risky sign-ins

Hands-on demo

Factor 1 — something you know

Why this matters

A password is something you know — and knowledge can be phished, leaked, or guessed. A registered device is something you have — an attacker who only has your password still needs to physically possess or control your phone to complete the second factor.

Even a 100% correct, freshly phished password only satisfies half of the requirement.
An unexpected MFA push is itself a signal — the real owner now knows their password leaked.
Adaptive MFA can escalate this challenge further for logins from new devices or locations.

Try it yourself

Try it yourself — run a scenario below, then flip this and replay it to see what changes.

Password + MFA Success

The legitimate user clears both factors in sequence.

Want this flow explained in detail as it plays?

app.flowground.dev/login

Log in

Password

••••••••
User
App
Authenticator App
Factor one (something you know) passes.

Selected hop

Correct password submitted

User

The person using the app.

App

The application's backend — enforces business rules and decides what every request is allowed to do.

What happens here

Factor one (something you know) passes.