Training module
Multi-factor authentication and passkeys
What the second factor adds, which kinds are stronger than others and why passkeys resist fake sites.
What you will be able to do
- Name the three kinds of factor and give an example of each.
- Rank SMS codes, authenticator apps and security keys by resistance to phishing.
- Explain why a passkey cannot be typed into a lookalike site.
Three kinds of proof
Authentication factors are something you know (a password), something you have (a phone, a security key) and something you are (a fingerprint or face). Multi-factor authentication combines at least two different kinds. A password plus a security question is not multi-factor: both are things you know.
What it protects against
If a password leaks or is guessed, the second factor still stands between the attacker and the account. This is why enabling it on the main e-mail account is the single most useful step for most people: that account can reset almost everything else.
Not all second factors are equal
A code sent by SMS is better than nothing, but it can be redirected by a SIM swap and a victim can be talked into reading it out. A code from an authenticator app is stronger against those, yet it can still be typed into a fake page in real time. A hardware security key or a passkey answers only the genuine site, so it resists this relay of codes.
- Best: passkey or hardware security key.
- Good: authenticator app.
- Acceptable when nothing else is offered: SMS code.
How a passkey works
A passkey is a key pair. The private key stays on your device and never leaves it; the site stores only the public key. When you sign in, your device signs a challenge that includes the site's real address. A fake site has a different address, so the signature is useless to it, and there is no password to type or to leak from the site's database.
Recovery planning
A second factor that you lose is a lock-out. Keep backup codes on paper, register a second key or device where the service allows it, and know how recovery works before you need it.
Key points
- Start with the e-mail account.
- Prefer passkeys and security keys; use an app over SMS.
- Prepare recovery before you need it.
Check yourself
Choose an answer to see the explanation. You can start again at any time.
1. Which pair counts as multi-factor authentication?
The two must be different kinds: here something you know and something you have.
2. A page that looks like your bank asks for the app code you just received. What does this show?
Codes can be relayed. Only a passkey or security key checks the site's address for you.
3. Why can a passkey not be used on a lookalike site?
The signature covers the real address, so a different domain receives nothing it can reuse.
Go further
Sources
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).