Multi-Factor Authentication (MFA) provides an extra layer of security over a person’s password to ensure the account is safe from unauthorized access. 99% of credential attacks are by password stealing; yet 90% of the attacks on credentials are thwarted by 2FA (two-factor authentication) or MFA.
MFA works by requiring a person to provide multiple pieces of evidence to verify their identity. These factors fall into three categories: something you know (like a password), something you have (like a phone or a passport), and something you are (biometric data).
Passwords alone are vulnerable to phishing or keylogging attacks; by combining these factors, MFA significantly reduces the risk of unauthorized access; even if one factor is compromised, the attacker would still need to bypass the other factors to gain entry. Authenticator apps or hardware security keys are a more secure option for ‘something you have,’ as they are not vulnerable to several SMS risks. Combing a PIN or biometrics such as voiceprints, fingerprints, and facial features with an authenticator app or keyfob maximizes protection.
SMS authentication verifies a person’s identity with a one-time password (OTP) code that is sent to a phone number on file via text message. Authenticator apps and hardware (HW) keyfobs verify a person’s identity with a time-based one-time password (TOTP) code that the application and server generate separately. After setup, the server and application don’t need to communicate directly.
TOTP authentication does not have to wait for a text message, a person can simply open the app and get the code instantly. This eliminates the possibility of delays caused by network issues or signal problems.
Weaknesses of SMS Authentication
One major concern is its vulnerability to interception by bad actors. SMS messages can be intercepted or redirected with an attack known as a ‘Man-In-The-Middle’ attacks where bad actors intercept traffic to steal or modify the SMS codes. SIM swapping (or SIM Replicate) convinces a service provider to move a phone number to the bad actor to steal SMS codes.
Perhaps the most frequently exploited threat is the use of social media to trick a person into giving up their authentication. Using either a technique called SMS Fatigue to overwhelm or desensitize a person with excessive SMS messages, or SMS phishing (smishing) where fraudsters use the same techniques as in phishing mail to steal verification codes and gain access to a person’s account.
Benefits of Using an Authenticator App
Authenticator apps have a distinct advantage in security; where SMS texts are vulnerable to communication threats, authenticator apps generate codes locally making it far more difficult to compromise. Furthermore, authenticator apps do not rely on internet or cellular signal making them more reliable and accessible in remote areas.
The National Institute of Standards and Technology (NIST) no longer recommends SMS in multi-factor authentication in favor of other MFA options, due to insecurities. Likewise, many companies, like Microsoft and Google, also recommend using authenticator apps for MFA. A good practice is to protect the authenticator app with a PIN code.
Benefits of a Security Key
A physical security key, like the Yubico Security Key C NFC, is a physical object that produce codes sent by Bluetooth, NFC, or USB and is the most secure MFA option since it’s a dedicated authentication device that keeps the secrets stored in the hardware. That basically makes it impossible to extract the secret remotely. Whether to use a security key or authenticator app depends on what your personal risk tolerance is; it is also much easier to use an authenticator app but puts all your security protection on your cell phone. Many major companies support account authentication using hardware security keys, including Apple and Google.
How Authenticator Apps and Security Keys Work
Authenticator apps use a time-based one-time password (TOTP) algorithm. This generates unique codes by blending a shared secret key and the current time. This key is encrypted and stored on your device to thwart unauthorized access.
When setting up an authenticator app, a person registers their phone with a service provider. The service generates a shared secret (usually a QR code) that is validated by the app. Once a person links it to their online account, the app generates codes that combines the secret key and synchronized time to craft a unique final code. The secret keys stay locally stored and are never transmitted adding an extra layer of security. The server receiving this code uses the same technique to generate a code from the secret key and current time. If the codes match, account access is granted. Good TOTP apps are available from Google and Microsoft.
Comparison Between SMS Authentication and Authenticator Apps
In summary, SMS may be easier and more familiar but even though authenticator apps, hardware keyfobs, passkeys, and voiceprints require a little bit more setup, they are more secure and reliable.
| SMS | Authenticator App | Hardware Security Key |
Connectivity | Cellular connection | Works offline | Works offline |
Compatibility | Works on all mobile devices | Smartphone needed | USB-A or USB-C |
Convenience | Simply get a text message | Initially, must install and configure an app | Yet another thing to carry around |
Cost | Often part of a phone plan | Free | ~$25 USD |
International | May not work in all countries | Works offline | Works offline |
Security | LEAST Secure MFA | Strong; keys stored in cloud or datastore | Strongest; key is on hardware |
