Security
MFA methods compared: SMS, TOTP, push, email codes and passkeys
Which second factors resist phishing and which do not, what NIST SP 800-63B says about SMS and OTPs, and how to choose MFA for a multi-tenant product.
The short answer
Not all MFA is equal. One-time codes — SMS, email, authenticator apps (TOTP) — and simple push approvals all stop password reuse but can be phished in real time by a proxy site. Only cryptographic, origin-bound authenticators such as passkeys and FIDO security keys resist phishing. NIST SP 800-63B classifies SMS and voice OTP as a restricted authenticator because of SIM-swap and interception risks.
Sources last reviewed .
Comparison
- SMS or voice code: widely available, vulnerable to SIM swap, interception and real-time phishing. NIST treats it as restricted.
- Email code or link: only as strong as the email account; phishable.
- TOTP app: no carrier dependency, phishable in real time.
- Push approval: convenient; vulnerable to fatigue attacks unless number matching or context is shown.
- Passkeys and FIDO security keys: phishing-resistant because the signature is bound to the site's origin.
Choosing for a multi-tenant product
Different tenants will want different minimums. Let tenant policy require MFA and restrict which methods count, offer phishing-resistant methods as the strongest option, and make recovery at least as strong as the weakest allowed factor (OWASP Multifactor Authentication Cheat Sheet).
In Authreads
How this applies to Authreads
Available today: passwords, emailed one-time codes, passkeys, authenticator apps (TOTP) and single-use recovery codes, with each tenant choosing which methods are allowed. SMS codes are not offered.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.