User Authentication · 5.3

📱 Multi-Factor Authentication

Why two factors from different categories is qualitatively stronger than one⏱ ~2 min

TOTP — Time-Based One-Time Password

TOTP (RFC 6238) is the mechanism behind Google Authenticator, Authy, and most '6-digit code' MFA. Setup: the server and your phone share a secret seed during enrollment (usually via QR code). At login: both sides independently compute HMAC-SHA1(seed, floor(current_time / 30)) and truncate to 6 digits. If your 6-digit code matches the server's calculation → you have the seed → authentication succeeds.

★ FactTOTP codes are valid for 30 seconds. The server typically accepts the current and previous window (60 seconds total) to account for clock skew. The shared seed never travels over the network at login time — only the 6-digit derived code does.

FIDO2 / WebAuthn — Phishing-Resistant MFA

TOTP codes can be phished — a fake login page can capture your 6-digit code and use it immediately. FIDO2 (Fast IDentity Online 2, using the WebAuthn standard) is phishing-resistant by design. The authenticator (YubiKey, phone, Windows Hello) signs a challenge that includes the domain name. If you're on a phishing site with a different domain, the signature will be for the wrong domain and authentication fails.

MFA Method	Phishing Resistant	SIM Swap Resistant	Usability
SMS OTP	❌ No	❌ No (SS7 attack, SIM swap)	High — no app needed
Email OTP	❌ No	✓ Sort of	High — no app needed
TOTP (Authenticator app)	❌ No (can be phished in real-time)	✓ Yes	Medium — need app
FIDO2/WebAuthn (hardware key)	✓✓ Yes	✓ Yes	High — tap key or use biometric
Passkeys (FIDO2 on device)	✓✓ Yes	✓ Yes	High — built into phone/laptop

Passkeys — Replacing Passwords Entirely

🔒 SecurityPasskeys (built on FIDO2) replace both password AND second factor with a single device-bound cryptographic key pair. You register a passkey with a website — your device generates a key pair, sends the public key to the server, and stores the private key in a secure enclave (TPM chip, Secure Enclave on Apple devices). Login: device signs a server challenge with the private key, verified with your stored public key. No password. No OTP. No phishing possible. Apple, Google, Microsoft, and GitHub all support passkeys.

💡 TipFor your own accounts: upgrade to FIDO2 hardware keys (YubiKey 5 series, Google Titan) for highest-value accounts (email, bank, password manager, domain registrar). For everything else, use TOTP over SMS. Never use SMS OTP for accounts you can't afford to lose.

🧠Quick Checkfirst try = +5 XP

What makes FIDO2/passkeys phishing-resistant?

🎮 Practice what you learned

🔓

Cipher Cracker

Break Caesar & substitution ciphers yourself

→🏰

Password Fort

See hashing & cracking in action

→

⭐ 0 XP🔥 0 days

Open the full interactive Cryptography module →