Authentication Security: Passwords, Passkeys, and Multi-Factor Authentication

User authentication represents the critical control boundary governing access to modern digital assets, enterprise servers, and cloud applications [1]. For decades, shared secrets—primarily passwords—served as the universal mechanism for identity verification. However, credential stuffing, database breaches, and sophisticated phishing campaigns have made password-only authentication an unsustainable enterprise vulnerability [1, 2].

To counter these vulnerabilities, security architectures have transitioned through two-factor authentication (2FA) and multi-factor authentication (MFA) to cryptographic passwordless credentials known as passkeys [1, 2]. In this technical guide, we evaluate the cryptographic mechanics of passwords, time-based one-time passwords (TOTP), and FIDO2/WebAuthn passkeys, analyzing their susceptibility to phishing and credential theft [1, 3].

1. The Anatomy of Password Vulnerabilities

A traditional password is a shared secret stored on a server (ideally in salted, iteratively hashed form using algorithms such as Argon2id or bcrypt) and memorized by the user [1].

The structural weaknesses of passwords stem from human cognitive limitations and transmission exposure:

• Credential Reuse: Users frequently reuse identical or slightly modified passwords across multiple personal and corporate services. A breach at a low-security third-party site compromises high-value corporate accounts.
• Phishing Susceptibility: Because passwords are typed into web forms, users can be tricked into entering them on malicious spoofed domains (e.g., lookalike domains via homograph attacks).
• Interception Risks: Shared secrets are transmitted across the network, exposing them to server-side logging errors, memory dumps, and reverse proxy interception [1].

In NIST SP 800-63B, official federal identity guidelines explicitly deprecated outdated password policies—such as mandatory 90-day periodic password rotations and complex character composition rules—recognizing that these practices cause users to choose predictable patterns rather than stronger passphrases [1].

2. Multi-Factor Authentication: Factors and Protocols

Multi-Factor Authentication requires users to present credentials across at least two distinct authentication factors [1]:

1. Something you know: Passwords, PINs, or security passphrases.
2. Something you have: Hardware cryptographic security keys, smartphone authenticators, or smart cards.
3. Something you are: Biometrics such as fingerprint scans or facial recognition.

SMS and Voice OTP (Restricted Authenticator)

Under NIST SP 800-63B, SMS and voice-delivered one-time codes are classified as "restricted" authenticators due to significant vulnerabilities [1]:

• SIM Swapping: Attackers use social engineering against telecom providers to redirect a victim's phone number to a rogue SIM card.
• SS7 Protocol Vulnerabilities: Global telecommunications signaling protocols lack end-to-end encryption, enabling sophisticated actors to intercept SMS traffic.
• Real-Time Phishing: Reverse-proxy phishing kits (such as Evilginx) intercept SMS codes entered by victims and replay them instantly to the real service.

Time-Based One-Time Passwords (TOTP - RFC 6238)

TOTP authenticators (such as Google Authenticator, Microsoft Authenticator, or Bitwarden) eliminate telecommunications risks by generating 6-digit codes locally on the device [3].

The algorithm computes an HMAC hash using a shared secret key ($K$) and the current Unix epoch time divided by a 30-second time step ($T$): $$T = \left\lfloor \frac{\text{Current Time} - T_0}{T_X} \right\rfloor$$ $$\text{TOTP} = \text{Truncate}(\text{HMAC-SHA-1}(K, T)) \pmod{10^6}$$

While TOTP protects against database credential reuse, it remains phishable: an attacker operating a transparent reverse proxy can capture and replay the 6-digit token within its 30-second validity window [1, 3].

3. Passkeys and FIDO2 / WebAuthn (Phishing-Resistant)

The FIDO2 standard, standardized by the W3C as WebAuthn and the FIDO Alliance as CTAP2, eliminates shared secrets completely through public-key cryptography [2].

+----------------+          WebAuthn API          +--------------------+
|                | -----------------------------> |                    |
|   Client App   |                                | Relying Party (RP) |
|   or Browser   | <----------------------------- | (Web Server)       |
+----------------+      Origin-Bound Challenge    +--------------------+
       |
       | CTAP2
       v
+----------------+
|  Authenticator |  (Hardware Key / TPM / Biometric)
| (Private Key)  |  Generates Cryptographic Signature
+----------------+

How Passkeys Work

1. Registration: The client device (via a TPM chip, Secure Enclave, or hardware security key) generates an asymmetric key pair: a private key that never leaves the secure hardware, and a public key transmitted to the relying party (server) [2].
2. Authentication Challenge: When logging in, the server sends an unpredictable random cryptographic challenge along with the server's canonical origin (e.g., deprogit.com).
3. Cryptographic Signing: The user authorizes the transaction with a biometric check (fingerprint/face) or device PIN. The authenticator signs the challenge using its private key [2].
4. Verification: The server verifies the signature using the stored public key.

Why Passkeys Are Truly Phishing-Resistant

The WebAuthn API automatically binds the cryptographic transaction to the browser's exact URL origin [2]. If an attacker lures a user to a fraudulent site such as login-deprogit.com, the browser passes the fake domain to the authenticator. Because the private key is strictly bound to deprogit.com, the signature fails, rendering credential harvesting impossible [2].

Technical Comparison of Authentication Methods

Practical Enterprise Migration Steps

Organizations transitioning toward modern authentication architectures should follow an incremental roadmap:

1. Eliminate SMS Verification: Transition users from SMS OTP to app-based TOTP or hardware security keys for all business-critical portals [1].
2. Deploy Passkeys on Enterprise IdPs: Enable FIDO2/WebAuthn authentication across primary identity providers (such as Microsoft Entra ID or Okta) [1, 2].
3. Protect Administrative Accounts: Mandate physical FIDO2 hardware keys (NIST AAL3) for all cloud root accounts, domain administrators, and production deployment pipelines [1].

To evaluate your organization's identity posture and deploy multi-factor authentication, visit our Cyber Security Solutions page.

Key Takeaways

• Traditional passwords fail due to credential reuse, weak entropy, and susceptibility to social engineering.
• SMS-based authentication is vulnerable to SIM swapping and telecommunications interception.
• TOTP tokens (RFC 6238) protect against reused passwords but remain vulnerable to real-time reverse proxy phishing.
• FIDO2 / WebAuthn passkeys provide cryptographic, phishing-resistant security by binding authentication to the exact domain origin.

Need help with this? Contact us.

Sources

[1] National Institute of Standards and Technology (NIST), "NIST SP 800-63B: Digital Identity Guidelines - Authentication and Lifecycle Management", 2020. URL: https://csrc.nist.gov/pubs/sp/800/63/b/upd1/final (Authoritative standard on authenticator assurance levels, memorized secrets, and MFA requirements).

[2] World Wide Web Consortium (W3C), "Web Authentication: An API for accessing Public Key Credentials Level 2", 2021. URL: https://www.w3.org/TR/webauthn-2/ (The formal open web standard governing public-key passkey authentication in modern browsers).

[3] IETF, "RFC 6238: TOTP: Time-Based One-Time Password Algorithm", 2011. URL: https://www.rfc-editor.org/rfc/rfc6238.html (Standards-track specification for HMAC-based time-synchronized one-time password generation).

Last reviewed: October 2026