MFA, everyone says you should be using it. We say that too, but not all MFA is created equal, and some MFA implementations have issues. Having tested many systems over the years we have seen some “interesting” implementations with weird behaviour which allows for bypassing MFA. Knowing these gotchas will help you find these issues and hopefully avoid the same mistakes.