MFA and passwordless sign-in: factors, FIDO2 and passkeys

Why one factor is not enough

Passwords are reused, guessed, phished and leaked in data breaches. Multi-factor authentication (MFA) asks for two or more different kinds of proof, so an attacker who steals one still cannot sign in. Two passwords are not MFA; a password plus a code from your phone is.

The classic factors are something you know, something you have and something you are. Modern identity providers add context signals, such as location and device health, through conditional access policies. These signals are not factors in the strict sense, but they help decide when to ask for more proof or block a sign-in.

Comparing MFA methods

You can try how one-time codes work with the TOTP tool. Notice that the code is just six digits: anyone you type it into, including a fake login page, can use it within its short validity window.

FIDO2, WebAuthn and passkeys

FIDO2 is a set of standards from the FIDO Alliance and the W3C. Its browser part is called WebAuthn. When you register, your authenticator creates a new public and private key pair just for that website. The private key never leaves the device. When you sign in, the website sends a challenge, and the authenticator signs it only if the website's domain matches the one it registered with.

That domain check is what makes FIDO2 phishing-resistant. A look-alike site on a different domain simply gets no valid signature, so there is nothing for the attacker to relay. A passkey is a FIDO2 credential that is usually unlocked with your fingerprint, face or device PIN, and may be synced between your devices by the platform (for example through a password manager or the operating system vendor's keychain). A device-bound passkey, such as one on a hardware security key, never leaves that device.

Rolling out MFA at work

1. Turn on MFA for all administrators first, using FIDO2 keys or passkeys.
2. Block legacy authentication protocols that cannot do MFA (old mail protocols, for example).
3. Enrol all users, preferring authenticator apps with number matching or passkeys over SMS.
4. Use conditional access to require stronger methods for risky sign-ins and sensitive apps.
5. Plan recovery: spare keys, verified help-desk processes and break-glass accounts.
6. Monitor for repeated MFA denials, which may signal a fatigue attack.

Tip: the help desk is often the weakest link. An attacker who can persuade support to reset MFA bypasses it entirely, so verify identity carefully before any reset.

Remember that MFA protects the sign-in, not the session that follows. Attackers increasingly steal session cookies with adversary-in-the-middle phishing kits, which is another reason to prefer phishing-resistant methods and short session lifetimes. See also strong passwords and MFA for the basics.