Chapter 3 · Authentication & Access· Beginner· ~9 min

MFA & Biometrics

One factor is a single point of failure. Two factors, done right, turn a password leak into a near-miss.

You will learn

  • The three classic authentication factors
  • Why SMS codes are weaker than app codes or hardware keys
  • What biometrics actually prove (and what they don't)
  • What WebAuthn / passkeys change

Three kinds of factor

The textbook split:

  • Something you know, password, PIN, secret answer.
  • Something you have, phone, hardware key, one-time-password app.
  • Something you are, fingerprint, face, voice.

Multi-factor authentication just means combining at least two of these so that an attacker needs to compromise more than one to log in as you. Two of the same kind (two passwords) isn't MFA.

The MFA ladder, weakest to strongest

  1. SMS codes. Better than nothing, but vulnerable to SIM swap, SS7 attacks, and phishing. Treat as a fallback, not a primary.
  2. Email codes. Slightly better than SMS, since your email is usually behind its own MFA. Still phishable.
  3. Authenticator apps (TOTP). The six-digit code that refreshes every 30 seconds. No phone-number attack surface, but still phishable.
  4. Push approvals. A "tap yes" on your phone. Convenient, but vulnerable to MFA fatigue (spam the user until they tap yes).
  5. Hardware security keys / passkeys (WebAuthn / FIDO2). Cryptographic challenge-response bound to the real site's origin. Resists phishing by design.

SMS is the weak link

If your bank lets you reset a password using SMS, an attacker who can convince your mobile carrier to swap your number is now you. Move to app-based codes or a security key wherever possible.

What biometrics really prove

Fingerprint and face unlock are convenient, but it's worth being precise about what they do:

  • They typically unlock a key that is stored in a secure element on the device. The biometric never leaves the device.
  • They prove you have physical access to this specific device, not that the person at the keyboard is who they claim to be.
  • You can't change a fingerprint after it leaks. Biometrics are not a great fit for cross-site authentication on their own.

That's why modern systems pair biometrics with a key the device holds (a passkey). The biometric is a local unlock; the actual authentication happens with cryptography.

WebAuthn and passkeys

WebAuthn is a browser API that lets a site challenge a device to sign something with a private key. The private key never leaves the device (often a hardware security element). The browser also checks that the request is going to the right origin, which is what makes it phishing-resistant: a fake login page can't trick the device into signing for the real site.

A passkey is the user-facing name for a WebAuthn credential that can sync across your devices (via iCloud Keychain, Google Password Manager, etc.). The big shift: no shared secret to phish, no SMS to intercept, just a key on hardware you control.

If you can only do one thing

Turn on MFA for your email account. Almost every "forgot password" flow in your life ends in your inbox, protect that, and you protect the rest.

Take the quiz