Authentication factors and their strength

Authentication relies on factors: something you know (a password or PIN), something you have (a phone, a security key) and something you are (a fingerprint or face). Combining factors from different categories is multi factor authentication.

But MFA methods are not equal. What matters most today is whether a method is phishing resistant.

Comparing common methods

• SMS or voice code: SIM swapping and interception, and a phishing page can relay it.
• Email code: only as strong as the email account, and relayable.
• Authenticator app code (TOTP): can be typed into a fake page and relayed in real time.
• Push approval: open to MFA fatigue, and relayable unless number matching is used.
• Push with number matching: better, but an adversary in the middle proxy can still relay it.
• FIDO2 security key or passkey: bound to the real site's domain, so phishing resistant.
• Certificate based (smart card): phishing resistant, but more complex to manage.

Why domain binding matters

With FIDO2 and WebAuthn, the browser tells the authenticator which website is asking. The authenticator only signs the challenge for the exact domain the credential was registered on. A fake login page on a look alike domain simply cannot obtain a valid signature, no matter how convincing it looks. This removes the human judgement that phishing exploits.

Passwords are not going away overnight

Many systems still need passwords. Make them less harmful:

• Require length over complexity: long passphrases beat short complex strings.
• Block known breached and common passwords at creation time.
• Stop forced periodic rotation without cause; it leads to predictable patterns. Current NIST guidance agrees.
• Encourage or provide a password manager.

Risk based choices

Not every account needs the same protection. Prioritise phishing resistant methods for:

1. Administrators of the identity provider, cloud and email.
2. Finance and HR staff who approve payments or change bank details.
3. Executives and their assistants.
4. Then everyone else.

Recovery is part of authentication

If resetting MFA only requires a phone call and a few public facts, attackers will use that path. Define strong recovery: identity verification through a manager, video with ID, or a pre registered backup authenticator. Treat help desk resets as high risk events and log and review them.