Innomerc Learn
English is the default.
A worked example

A stolen password meets a second check

One exchange at a time. Read what changes, then explain it in your own words before moving on.

  1. Meet the components
  2. Follow the steps
  3. Compare an example
  4. Check your understanding
Interactive Lab

A stolen password meets a second check

Follow the attacker’s request to the exact point where the outcome changes.

Steps1. Stolen password 2. Challenge 3. Denied
Click a box or choose its name to learn what it means.
Sign-in clientReadyIdentity serviceReadyAuthenticatorReadyPrivate accountReadySign-in clientReadyIdentity serviceReadyAuthenticatorReadyPrivate accountReady
Ready to traceMFA enforced
Before you start · 3 stepsMFA enforced

A password alone does not satisfy this account’s sign-in policy.

How to use this example

Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.

Inspect components & read every step
  • Sign-in client

    The browser or app sending a request to enter an account.

    Example: Your phone sends a sign-in request to an identity service.

  • Identity service

    A system that checks identity and manages sign-in decisions.

    Example: It checks a password and may require an additional authentication factor.

  • Authenticator

    A device or method used to prove control of an authentication factor.

    Example: A security key or an authenticator app helps verify a sign-in. Methods have different protections against phishing.

  • Private account

    The protected account reached only after the required checks succeed.

    Example: Your email inbox should not open for someone who fails sign-in checks.

MFA enforced

A password alone does not satisfy this account’s sign-in policy.

  1. Sign-in client Identity service: Stolen password. The supplied password passes the first check.
  2. Identity service Authenticator: Challenge. A registered second factor is required.
  3. Identity service Sign-in client: Denied. No acceptable second-factor proof arrives; no session is issued.

Password only

This weaker policy issues a session on a matching password alone.

  1. Sign-in client Identity service: Stolen password. The attacker has the correct password.
  2. Identity service Private account: Issue session. No independent second factor is required.
  3. Private account Sign-in client: Access. The stolen password was enough in this policy.

Legitimate sign-in

Independent factor evidence completes the configured policy.

  1. Sign-in client Identity service: Password. The first factor is checked.
  2. Identity service Authenticator: Challenge. The registered authenticator receives the challenge.
  3. Authenticator Identity service: Valid proof. The service verifies the second-factor evidence.
  4. Identity service Private account: Issue session. The authenticated session is issued.

Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.