SSO, MFA and Why Your Online Security Matters More Than You Think

I've been thinking a lot about cybersecurity recently, especially how much responsibility everyday users have for keeping their online accounts secure.

Working in development, you get quite used to dealing with authentication, passwords and the various security measures that come with accessing different systems. But outside of the technology industry, I wonder how many people actually understand what some of these measures do, or why they're important.

Most of us have probably experienced being asked to enter a code sent to our phone, approve a login through an app, or sign in using an existing Google or Microsoft account. They're all relatively normal parts of using the internet now, but they're also things that can feel unnecessarily complicated when all you want to do is log in and get on with your day.

The two things I want to focus on are Multi-Factor Authentication (MFA) and Single Sign-On (SSO). They're often discussed together, particularly in workplace environments, but they serve different purposes and can be just as relevant to our personal accounts.

What's wrong with just using a password?

Passwords have been around for what feels like forever, and for the most part, we've all become accustomed to using them.

The problem is that we're not particularly good at managing them - even the more technical of us.

We're all encouraged to create long, complex passwords, avoid reusing them and change them if they've been compromised. That's all well and good, but when you consider how many online accounts the average person has, it quickly becomes a lot to manage.

I'm sure most people have reused a password at some point, or created a variation of an existing password because remembering another completely unique one seemed like too much effort.

Unfortunately, this is exactly where problems can, and usually do, start.

If a website suffers a data breach and your credentials are exposed, attackers can attempt to use those same details to access your other accounts. This is known as credential stuffing, and it's one of the reasons password reuse is such a problem.

Even a strong password isn't completely immune to being compromised. Phishing emails, malicious websites and data breaches can all expose credentials without the account owner necessarily doing anything obviously wrong.

This is where extra authentication becomes so important.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication adds another layer of security to the login process.

Rather than relying solely on a password, it requires an additional form of verification to confirm that the person attempting to access the account is actually who they claim to be.

This usually involves a combination of something you know, such as a password, something you have, such as your mobile phone or a security key, or something you are, such as your fingerprint.

For example, when you log into a website, you might enter your email address and password, then be prompted to approve the login through an authenticator app.

It adds an extra step, which can be frustrating if you're in a hurry, but that small inconvenience can make a significant difference.

If somebody does manage to obtain, through malicious means or otherwise, your password, they may still be unable to access your account without completing the additional verification.

It's worth mentioning that MFA isn't completely foolproof. Attackers can still use phishing techniques to steal verification codes or trick users into approving login requests. However, that does make account compromise considerably more difficult than relying on a password alone.

Not all MFA methods offer the same level of protection either. SMS verification is better than having no additional protection, but authenticator apps and particularly phishing-resistant methods, such as passkeys and physical security keys, can offer stronger protection.

What about Single Sign-On (SSO)?

Single Sign-On works a little differently.

Rather than adding another verification step, SSO allows users to access multiple applications through a central authentication system.

If you've ever used a 'Continue with Google' or 'Sign in with Microsoft' button, you've probably encountered a form of federated login, which uses a similar principle.

Instead of creating a completely new username and password for every application, an existing identity provider handles the authentication process.

In a workplace, this might mean signing into your Microsoft account and then being able to access several company applications without repeatedly entering your credentials.

For everyday users, the biggest benefit is convenience, but there are potential security advantages too.

Having fewer passwords to remember reduces the temptation to reuse the same password across multiple websites. It also means authentication can be managed through a provider that supports stronger security measures.

However, there is a trade-off.

If you're using one account to access several different services, that account becomes particularly important to protect. If it's compromised, an attacker may potentially gain access to other linked applications. Losing access to the account could also prevent you from signing into those services.

It's one of the reasons that SSO and MFA work particularly well together - SSO can simplify the login process, while MFA provides additional protection for the account responsible for authenticating you.

Why does this matter to everyday users?

One thing I find interesting about cybersecurity is how often it's presented as something that primarily concerns businesses, developers or IT departments. In reality, almost everybody has something worth protecting online.

Our email accounts, social media profiles, banking applications and online shopping accounts all contain information that we wouldn't necessarily want somebody else accessing. The consequences of losing access aren't always limited to the account itself.

Take your email account, for example. It's probably connected to a significant number of your other online services. If somebody gains access to it, they may be able to request password resets for other accounts, access personal conversations or find sensitive information.

It's quite a worrying thought when you consider how much of our digital identity revolves around a single email address.

This is why I think protecting your primary email account with MFA should be one of the first things anybody does when reviewing their online security.

It's also worth remembering that cybercriminals don't necessarily need to target you personally. Automated attacks can attempt to access enormous numbers of accounts using previously exposed credentials.

You don't need to be a public figure, run a business or have anything particularly interesting on your social media profiles to be affected.

Security shouldn't have to be complicated

One of the biggest challenges with cybersecurity is finding a balance between security and usability. If a security measure becomes too frustrating, people naturally look for ways around it or avoid enabling it altogether.

I don't think the solution is to expect everybody to become an expert in cybersecurity. Instead, we should be making secure options more accessible and helping people understand why they matter.

There are a few relatively straightforward things that can make a difference:

• Enable MFA on your important accounts, particularly your primary email, banking and social media accounts.

• Use a password manager to generate and store unique passwords rather than trying to remember them all.

• Consider passkeys where they're supported, as they can provide a simpler and more phishing-resistant way to sign in.

• Be cautious with unexpected authentication requests. If you receive a login approval notification that you didn't initiate, don't approve it.

• Review your recovery options, including backup codes and recovery email addresses, so you don't accidentally lock yourself out of your own accounts.

None of these measures guarantees complete protection, but they can reduce the likelihood of somebody gaining unauthorised access.

Final thoughts

As technology becomes increasingly integrated into our everyday lives, I think understanding the basics of online security is becoming just as important as knowing how to use the technology itself.

We shouldn't need to understand the technical details of authentication protocols to appreciate why an extra verification step might protect our personal information.

For me, the biggest takeaway is that convenience and security don't necessarily need to work against each other.

SSO can make accessing applications easier, while MFA can make those accounts more difficult to compromise. Combined with better password management and an awareness of common threats, they can make a meaningful difference to how we protect ourselves online.

And if enabling MFA means spending an extra few seconds logging into an account, I think that's a relatively small price to pay for a little more peace of mind.