--- title: "MFA" description: "9 posts about MFA, summarised, each linking to the original." --- # MFA > 9 posts about MFA, summarised, each linking to the original. ## Articles ### [Making password login safer on Notion](https://yomu.fyi/post/making-password-login-safer-on-notion.md) - Company: [Notion](https://yomu.fyi/company/notion.md) - Author: Ankit Gupta - Published: Oct 13, 2026 - Type: Announcement Notion is requiring a second step of verification for password login to protect against credential reuse from other site breaches, and this change will roll out in stages over the next few months. When users set or change a password, they will be guided to set up two-step verification via an authenticator app or phone number and should save the backup codes provided. Users who already have two-step verification on their password need no action, and those without a password can continue using passkeys, email codes, or SSO. For password-only users without two-step verification, Notion will provide notice and time to set up a second step before turning off password-only login; if they choose not to, another method like an email code can still grant access. Additionally, where Notion can verify that another working method exists, it plans to turn off password login for those unused passwords. ### [Seven Architectural Readiness Checks Before Production Launch](https://yomu.fyi/post/seven-architectural-readiness-checks-before-production-launch.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Carlos Aguilar - Published: Sep 30, 2026 - Type: Tutorial Auth0’s free tier supports up to 25,000 MAUs for MVPs, but teams must complete seven architecture checks before production launch to avoid blockers. The checks cover Auth0 Organizations for multi-tenancy, Enterprise Connections for SSO, Custom Domains, JIT hash migration, Fine-Grained Authorization, MFA factor progression, and tenant lifecycle management. The free plan caps Organizations at five, Enterprise Connections at one plus unlimited Okta, and MFA at passwordless and passkeys only. Upgrading to B2B Essentials or Professional unlocks unlimited organizations, up to five enterprise connections, and advanced MFA including TOTP, WebAuthn, push, and SMS; Professional also enables Custom Database migration scripts. Teams must add a credit card for Custom Domains, add a secondary admin to prevent tenant deletion after 150 days of inactivity, and note that FGA free trial supports 100 MAUs and 50,000 tuples for prototyping. ### [Stop Building MFA from Scratch (And What to Do Instead)](https://yomu.fyi/post/stop-building-mfa-from-scratch-and-what-to-do-instead.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Alisha Tingle - Published: Sep 25, 2026 - Type: Explainer Building multi-factor authentication (MFA) in-house is a much larger project than teams expect, requiring authenticator app integration, QR code generation, secure backup recovery codes, and edge cases like lost phones. Auth0 positions its MFA offerings as a way to offload that work so developers can focus on core product features. The company’s paid plans include MFA directly, with Pro MFA covering standard authenticator apps in B2C and B2B Essentials plans. Enterprise MFA adds WebAuthn, push notifications, SMS, and voice, available as an add-on to B2B Essentials or included in Professional tiers. Auth0 argues that using its MFA helps teams pass compliance, unblock enterprise deals, and avoid weeks of building login infrastructure. ### [Preventing Destructive Actions with Step-up Authentication](https://yomu.fyi/post/preventing-destructive-actions-with-step-up-authentication.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Jessica Temporal - Published: Sep 17, 2026 - Type: Tutorial The Agentic Arcade’s admin panel adds an admin-only “reset all scores” action to prevent a long-lived or stolen admin session from wiping every player’s history. It combines the arcade-admin role with step-up MFA, requiring a recognized MFA signal and auth\_time or iat within five minutes. A shared helper checks amr, acr, or a tenant claim; buildMfaStepUpUrl uses acr\_values and can add max\_age=0, while mfa.challengeWithPopup() opens MFA before the reset request. A beforeSessionSaved hook preserves claims filtered by the Auth0 Next.js SDK, and the API enforces session, role, and freshness gates before clearing scores; cancelled or blocked popups stop the request. ### [Vibe Production-Ready Apps with Auth0 and v0](https://yomu.fyi/post/vibe-production-ready-apps-with-auth0-and-v0.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Juan Cruz Martinez - Published: Sep 16, 2026 - Type: Announcement Auth0 is launching an integration for v0 that lets builders add real authentication to prompt-built applications. v0 can respond to requests for login, protected routes, B2B use cases, enterprise identity providers, or MFA by creating Auth0 resources, configuring connections, and wiring its SDK into generated code. The integration operates within the v0 conversational workflow and builds on Auth0’s native Vercel integration, which syncs tenant configuration and credentials across development, preview, and production environments. This replaces placeholder authentication screens with authenticated sessions, protected access, and Auth0-specific implementation patterns including real session handling and protected routes. It is available in any v0 project today, with setup beginning by installing Auth0 from the project’s Integrations settings. ### [When AI takes the wheel: The rise of invisible identity intelligence in 2026](https://yomu.fyi/post/when-ai-takes-the-wheel-the-rise-of-invisible-identity-intelligence-in.md) - Company: [Twilio](https://yomu.fyi/company/twilio.md) - Author: Catie Kolander - Published: Sep 1, 2026 - Type: Explainer Point-in-time authentication treats an initial password, MFA, or passkey check as sufficient trust for the rest of a session, leaving post-login account takeovers, session hijacking, and risky API actions insufficiently evaluated. The proposed model replaces this front-door assumption with continuous context evaluation using passive telemetry such as network, telecommunications, device, behavioral, and transaction signals, then intervenes when risk scores or policy thresholds rise. For AI agents, delegated authority sets temporal, monetary, and API limits through short-lived credentials, while Know Your Agent lineage links execution to the authorizing human and deploying enterprise. High-impact actions can trigger human checkpoints through SMS, push, or voice channels, while immutable logs, transparent scoring, tenant isolation, and session lineage support auditability and compliance. The resulting architecture aims to keep low-risk autonomous work unobtrusive while making sensitive operations controllable and provable. ### [Secure Authentication with a Push Notification in Your iOS Device](https://yomu.fyi/post/secure-authentication-with-a-push-notification-in-your-ios-device.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Darko Spasovski - Published: Nov 18, 2025 - Type: Tutorial The tutorial shows how to build a native iOS sign-in flow using Okta DirectAuth and push notification MFA. It starts with an Okta Integrator Free Plan org, configures an OIDC Native Application and enables Okta Verify push notifications, while noting additional authorization policies may be required for a custom authorization server. In Xcode, the app uses Swift, SwiftUI, Swift Package Manager, and the Okta mobile Swift packages OktaDirectAuth and AuthFoundation to handle credentials, tokens, and MFA challenges without browser redirects. An AuthService coordinates authentication state, user and token information, sign-out, access-token refresh, and session restoration from stored credentials. The completed flow is described as phishing-resistant and able to maintain an active session directly within a SwiftUI app. ### [How to Build a Secure iOS App with MFA](https://yomu.fyi/post/how-to-build-a-secure-ios-app-with-mfa.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Darko Spasovski - Published: Aug 20, 2025 - Type: Tutorial This tutorial shows how to add secure authentication and backend authorization to an iOS app using Okta’s BrowserSignIn module from the Okta Swift SDK. It registers a native OIDC client with Authorization Code Flow and PKCE, configures redirect URIs and authorization-server policies, and recommends phishing-resistant MFA factors such as Okta Verify with biometrics and FIDO2 with WebAuthn. The implementation uses Swift Package Manager, an Okta.plist configuration file, a testable AuthService protocol, and SwiftUI views for login, token handling, user information, and authenticated state. It then demonstrates authorized API requests by attaching an access token to a URLRequest, calling a backend endpoint, decoding its response, and displaying a returned message, concluding that OAuth 2.0 and JWT validation provide integrated authorization verification. ### [Approaches to keep sending OTP over SMS... for now](https://yomu.fyi/post/approaches-to-keep-sending-otp-over-sms-for-now.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Maurice Sharp - Published: Aug 15, 2024 - Type: Explainer SMS and voice OTPs remain broadly applicable for identity verification, but the post argues they should eventually be replaced because SIM swapping, phishing, uncontrolled secret-delivery channels, device-linking gaps, and slower logins weaken them. Until then, Okta will require organizations to bring their own telephony provider, using a telephony inline hook to send codes and report outcomes. The implementation can be built in-house, outsourced, or delegated to a managed service, with regional regulations, traffic peaks, reliability, branding, security, and available resources shaping the choice. A hook has three seconds to return success or failure before Okta’s heavily rate-limited failover sends the message; teams must also secure endpoints and API keys, monitor logs, and handle vendor or delivery failures.