The Idea Behind MFA
Multi-Factor Authentication (MFA) requires more than one independent factor to prove who you are. The classic three categories:
- Something you know — a password, PIN, security question.
- Something you have — a phone, security key, smart card.
- Something you are — fingerprint, face, voice.
A real MFA setup uses factors from two different categories. Two passwords are not MFA. A password and a TOTP code are.
Why a Password Alone Is Not Enough
Passwords leak constantly:
- Through database breaches at sites you have used.
- Through phishing pages that look identical to the real site.
- Through infostealer malware on your own device.
- Through password reuse from a breach somewhere else.
Adding a second factor means that even with the password, the attacker cannot log in.
The MFA Methods, Ranked
1. Hardware Security Keys (FIDO2 / WebAuthn) — Strongest
A physical key (YubiKey, SoloKey, Titan) that signs a cryptographic challenge from the site. The key is bound to the site's origin, so even a phishing site cannot trick it into signing.
- Phishing-resistant: yes.
- MITM-resistant: yes.
- Best for: high-value accounts (email, banking, work admin).
2. Passkeys — Strong and Convenient
Same FIDO2 cryptography as hardware keys, but stored in your phone, laptop, or password manager. Synced across your devices, used with face or fingerprint unlock.
- Phishing-resistant: yes.
- Best for: everyday use, mainstream sites.
3. Push-Based Authenticator Apps — Good
Apps like Microsoft Authenticator and Duo send a push notification you approve. Better than codes because the user sees context (which account, from which device).
- Phishing-resistant: partial — susceptible to MFA fatigue attacks where the attacker spams pushes until the user approves one.
4. TOTP Codes (Authenticator Apps) — Good
Apps like Google Authenticator, Authy, Aegis. Generate a 6-digit code every 30 seconds based on a shared secret.
- Phishing-resistant: no. A phishing site can ask for the code and use it within 30 seconds.
- Still vastly better than nothing.
5. SMS Codes — Weak But Better Than Nothing
A code sent by text message.
- SIM-swap vulnerable. Attackers transfer the victim's phone number to a SIM they control.
- Used by many banks because it is universally available, but should be replaced wherever possible.
6. Security Questions — Not Really MFA
"What was your first pet's name?" is something you know — same category as your password, and often discoverable by social engineering or OSINT.
What Attackers Do Anyway
Modern phishing kits like EvilProxy and Modlishka sit between the user and the real site, intercepting the session cookie after MFA is complete. This bypasses TOTP and SMS but not FIDO2/WebAuthn keys, because those bind cryptographically to the origin URL.
This is why hardware keys are increasingly mandatory at security-conscious organisations.
What You Should Do
- Enable MFA everywhere it's available. Email, banking, social media, cloud storage, work tools.
- Use the strongest method the site supports. Prefer passkeys or hardware keys over TOTP, and TOTP over SMS.
- Buy two hardware keys (one for daily use, one as a backup in a safe place) for your most important accounts.
- Save backup codes to your password manager — for the day you lose your phone.
- Be sceptical of unexpected MFA prompts. If you get a push or code you did not initiate, someone has your password — change it.
Conclusion
Passwords alone are a 1990s authentication design. In 2026, your attack surface is too large to defend with a single secret. Layered authentication makes the attacker's job exponentially harder — for almost no additional inconvenience to you.