What is two-factor authentication (2FA) and which method is the most secure?

"MFA is a security control that requires a user to present a combination of two or more different authenticators (something you know, something you have, or something you are) to verify their identity for login."

"Where feasible, hardware-based FIDO security keys, such as Yubico or Google Titan, are the most effective; however, FIDO passkeys are an acceptable alternative."

"Passkeys stored on FIDO2 hardware security keys are also "device-bound,""

"In recent years, phishing attacks have grown sophisticated enough to ask for 2FA codes, which SMS and authenticator apps have no protection against."

"Built on the FIDO2 standard, passkeys are a complete alternative to traditional passwords."

"When user verification is required as part of the login, FIDO2 authentication constitutes multi‑factor authentication."

"Vulnerable to phishing, SS7, and SIM swap attacks."

"Text messages are not the most secure type of 2SV, but still offer a huge advantage over not using any 2SV."

"These apps offer lots of advantages over text messages, such as not needing a mobile signal, or having to wait for a text message to arrive."

"A passkey is a secure, passwordless authentication method that allows you to log into an app and website using your existing device biometrics (like Face ID or fingerprints) or lock screen PIN."

"Users still depend on the security of their devices and credential managers, and services should give users clear ways to manage and remove credentials and to set up recovery options."

"Security keys are the strongest form of 2FA, but are not as widely supported on websites as other options."

"Many companies make free mobile authenticator apps, like Google Authenticator and Authy."

"You may contact Customer Support if you need assistance determining which terms and conditions apply to your product or service."

"Enrollment in authenticator-based MFA does not automatically unenroll the account’s SMS."

"Some online services may default to SMS during account recovery flows, so it may not be feasible to completely eliminate SMS messages from the service."

"Each code works exactly once to log in to your account, and is no longer usable thereafter."

"It's also a good idea to have a backup plan, in case you haven't got access to your usual second step"

"security key 2FA and passkey authentication are effectively phishing-proof, because the key will not work on a site that it's not registered for."

"This form of MFA should only be used as a last resort MFA option."

"Text messages are not the most secure type of 2SV, but still offer a huge advantage over not using any 2SV."

"the code sent from SMS or generated in your 2FA app, or a security key"

"An authenticator app generates rotating six-digit codes that are specific to each website you’ve registered with it."

"Security keys plug into your computer or phone through USB, or connect to phones wirelessly with NFC."

"Authenticators that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant."

"The user submits their username, password, as well as the 6-digit code from their mobile phone's authenticator app."

"SIM Swap is a form of social engineering in which cyber threat actors convince cellular carriers to transfer control of the user's phone number to a threat actor-controlled SIM card, which allows the threat actor to gain control over the user's phone"

"SS7, and SIM swap attacks are not applicable"

"Effective March 20, 2023, we will no longer support two-factor authentication using text messages for non-Premium subscribers."

"A second factor can also be another physical device that you purchase separately, called a security key."

"can be stored on your phone or computer, or in a hardware security key"

"Some accounts also give you a list of backup codes when you switch on 2SV."

"Remember to keep the codes secure and ensure that no one else sees them"

"Look-up secrets are not phishing-resistant."