Choosing an MFA Method

The strongest multi-factor authentication method on paper isn't necessarily the right choice for every situation. You have to balance phishing resistance against device support, cost, user friction, and recovery. Some of the trade-offs are:

• TOTP is inexpensive, works offline, and runs in widely available authenticator apps. However, its codes can be phished and relayed, and the server has to protect a shared secret.
• Dedicated security keys use WebAuthn to provide phishing-resistant authentication. They're good for privileged staff and high-risk actions, but the organization has to purchase, provision, replace, and support the keys.
• Passkeys provide similar origin-bound protection to dedicated WebAuthn keys without always requiring a separate device. They are awesome, but recovery and moving between credential-provider ecosystems can still be challenging.

Weakest Path Wins

If multiple auth methods are enrolled for an account, its protection is ultimately determined by the easiest sign-in or recovery path that an attacker can exploit. If an account accepts TOTP as a fallback, an attacker can target that method, even if the user normally signs in with a passkey.