The Royal Armoury · Notice the Third

Free MFA Poster: The Second Factor

The thief has your password, subject. He did not work for it and he did not break anything to get it. He bought it, the way you would buy a fish. What stops him is the second thing your door asks for, and it costs you a minute to arrange.

Free two-factor authentication poster: a royal decree headed THE SECOND FACTOR, illustrated with a hooded thief bowed against a shut castle door holding a stolen scroll, above a ranked record of what beats a password alone — The accused, defeated by a door. He is not picking the lock and he is not breaking anything. He is standing outside with a perfectly good password, discovering that it was never the only question.

Take up arms

Printable at A4 and US Letter, free, for a workplace noticeboard or a classroom wall. If you are running MFA awareness training, or an awareness campaign that has to cover the second factor in one sheet, this is the sheet.

Issue	PDF	Image	Slides
A4, full colour	PDF 640 KB	PNG 5.2 MB	—
US Letter, full colour	PDF 594 KB	PNG 4.9 MB	—
A4, black and white	PDF 724 KB	PNG 783 KB	—
US Letter, black and white	PDF 671 KB	PNG 671 KB	—
Web and newsletter	—	JPG 448 KB	—
Presentation slide	—	PNG 1.9 MB	PPTX 1.9 MB

Print from the PDF. Its parchment is lighter than the one on this page, because a screen is lit from behind and a sheet of paper is not: the darker ground comes out muddy on a colour printer and eats a cartridge doing it. The PNG is the screen edition. The black and white issue asks the least of any printer and is unchanged.

The black and white issue is for the printer down the corridor, the one with only the black cartridge left in it. Same thief, same door, no gilding.

The PowerPoint slide arrives with speaker notes from the court: what each row means in plain terms, what to say to the person who insists it will slow them down, and why the logs would never have caught this. Drop it into any awareness deck; the King asks only his name on the door.

What beats a password alone, for the record

Multi-factor authentication, two-factor authentication, MFA, 2FA. Four names, one idea, and the heralds are aware of the problem. This court calls it the second factor, and so does the poster.

A password on its own is not one. Credentials are stolen from companies in bulk and sold on, so the safe assumption is that yours is already out there somewhere and whoever buys it can log in as you. The second factor exists for exactly that day.
A code sent by message: better than nothing. A thief can have your number moved to a phone he holds, by SIM swap, and the network itself can be attacked, which is why the standards bodies rank it last of the working options. It is still far better than no second factor at all, and the poster gives it a tick for exactly that reason. Nobody should switch it off on account of this sheet.
A code from an app: good. It is made on your device from a shared secret and a clock rather than sent to it, so there is nothing travelling for anyone to intercept, and it works with no signal: on a train, in a lift, abroad. It can still be typed into a convincing fake site, which is why it is not the top row.
A passkey: good, and free. There is no password to type, and none to steal: your device proves it is you, usually with your face or your fingerprint. A passkey can live on your phone, in the password manager you already keep, or on the key below, and it is the same thing in each case. Strictly it replaces the password rather than guarding it, which is why the list above is headed what beats a password alone rather than what counts as a second factor.
A key you tap or plug in: best. A thief would need it in his hand: it is a physical thing, and nothing about your password, your phone number or your inbox gets him one. It is also bound to the real site's address, so a lookalike page cannot use it even if you are completely taken in, which is the only option on the sheet that resists phishing rather than merely surviving it.

Turn it on for email before anything else, then banking, then anything holding payment details. Email first, because it is the account that resets all the others.

One thing the poster says quietly and the court will say plainly: a correct password used by the wrong person does not look like an attack in any record you keep. Nothing is forced, nothing is broken, and the door opens politely. The second factor is what stops it; the log only writes it down afterwards.

The full proceedings are on record: Do I really need two-factor authentication?, in which the court makes its own gate impossible and a thief walks into fifty households without touching one.

Putting an October campaign together? This poster and everything else worth using is gathered on the Cybersecurity Awareness Month page.

The terms of issue

Free to use unaltered: at work, in a classroom, in a newsletter, on any noticeboard that will have them. Not for resale. The credit is already printed on the thing, so there is nothing for you to add.

That is the whole treaty. The crown's lawyers are disappointed by its brevity and have been informed that the matter is closed.

Requests, questions and corrections reach the court at [email protected].

More arms are being forged. The smiths have finished arguing about the second factor and have moved on to the backups.