MFA (multi-factor authentication)

How it works

Factors fall into three families: something you know (a password, a PIN), something you have (a phone, a security key, a smart card), something you are (a fingerprint, a face). Two proofs from the same family don't count. A password plus a security question is still one factor.

The common implementations, from weakest to strongest:

• SMS codes. Cheap, universal, and the weakest option on the list. A SIM swap at a carrier shop or an SS7 interception hands the code to an attacker, and NIST has flagged SMS as a restricted authenticator in SP 800-63B since 2017.
• TOTP codes from an authenticator app, defined by RFC 6238. Better, because nothing travels over the mobile network, but a convincing login page still collects the six digits and replays them within 30 seconds.
• Push approvals. Convenient and the reason push fatigue attacks exist: the attacker, already holding the password, fires approval prompts at 2am until the user taps accept. That's how the Uber breach of September 2022 started. Microsoft made number matching the default in Entra ID in May 2023 precisely to kill the reflex tap.
• Phishing-resistant factors. FIDO2 and WebAuthn security keys, passkeys synced through iCloud Keychain or Google Password Manager, and client certificates. The secret is a private key bound to the hardware, it never leaves the Secure Enclave or the Android keystore, and the browser refuses to use it on a domain that doesn't match. Nothing for a fake page to capture.

Then there's the factor most teams forget to count: the device itself. A managed phone with a hardware-backed key and a compliance state reported by the MDM is a proof of identity that no attacker on another continent can present.

Why it matters for a fleet

On a mobile fleet, MFA has an awkward shape. The phone is both the asset you're protecting and the key to everything else. Lose it and the employee can't log in anywhere, including to the portal that would let them re-enroll a factor.

So the real work sits around the edges. Factor enrollment is the soft spot: if a new hire can register an authenticator from any browser with nothing but a password, an attacker can too. Helpdesk resets are the other one, and they're the path used in most of the social engineering incidents reported since 2023. Pin both to a known, enrolled device.

How Appaloosa handles it

Appaloosa doesn't issue authentication factors, your identity provider does. What it supplies is the device half of the equation: the authenticator app pushed automatically to the right groups at enrollment, passcode and biometric requirements enforced by policy, client certificates delivered to the device, and a compliance state that your IdP can treat as a signal. If a phone holding someone's second factor goes missing, selective wipe removes the work apps and their data without touching personal photos. Those continuous compliance checks on enrolled devices are what turn a company phone into a factor you can trust.