Death to one-time text codes: Passkeys are the new hotness

"Whether you're logging into your bank, health insurance, or even your email, most services today do not live by passwords alone. Now commonplace, multifactor authentication (MFA) requires users to enter a second or third proof of identity. However, not all forms of MFA are created equal, and the one-time passwords orgs send to your phone have holes so big you could drive a truck through them."

"Using someone's legitimate account credentials is a much more effective avenue for crims than finding a security hole to exploit. Microsoft's latest Digital Defense Report puts identity as the top attack vector. Using MFA of any kind is the main way to stave off identity attacks, but what you really want is a method that can stand up to phishing."

Multifactor authentication (MFA) is widely deployed beyond passwords, requiring additional proofs of identity. Not all MFA methods provide equal protection; one-time passwords sent via SMS or email are particularly vulnerable to phishing. Attackers increasingly phish users for both credentials and OTPs to gain access without exploiting software vulnerabilities. Identity-based attacks are a primary threat vector, and MFA remains the most effective defense, capable of blocking the vast majority of unauthorized access. Phishing-resistant MFA methods, including passkeys and hardware-backed authenticators, offer stronger protection. MFA approaches fall into categories of something you know, have, or are.

Read at Theregister