Multifactor, passwordless and biometric authentication

Adding a second factor is the single most effective step most organizations can take against account takeover. But not all second factors are equal. A one-time code sent by text message stops a password-spraying bot, yet a convincing phishing page can relay that code to the real site within seconds. A push notification is convenient until an attacker sends fifty of them at two in the morning and a tired user taps approve. Phishing-resistant authenticators, such as FIDO2 security keys, passkeys and smart cards, defeat both attacks because the cryptography is bound to the genuine site. This lesson compares the authenticators, explains NIST's authenticator assurance levels, works through one-time password algorithms and biometric accuracy, and sets out the legal rules that govern biometrics in Canada and the United States.

One-time passwords

A one-time password, OTP, is valid for a single use or a short time, so a captured code cannot be replayed later. Two open algorithms dominate. HOTP, defined in RFC 4226, computes a code from a shared secret key and a counter that increments with each use: it takes an HMAC-SHA-1 of the counter, extracts four bytes at an offset given by the last nibble, a step called dynamic truncation, and reduces the result modulo \(10^d\) for a \(d\)-digit code. TOTP, defined in RFC 6238, replaces the counter with the number of 30-second intervals since the Unix epoch, so codes change automatically. Authenticator apps implement TOTP; the shared secret is usually delivered once by QR code at enrollment.

import hmac, hashlib, struct
def hotp(key, counter, digits=6, alg=hashlib.sha1):
    mac = hmac.new(key, struct.pack('>Q', counter), alg).digest()
    offset = mac[-1] & 0x0F
    code = struct.unpack('>I', mac[offset:offset + 4])[0] & 0x7FFFFFFF
    return str(code % 10 ** digits).zfill(digits)
def totp(key, unix_time, step=30, digits=6):
    return hotp(key, unix_time // step, digits)
key = b'12345678901234567890'          # RFC test key, never use in production
print('HOTP counters 0-3:', [hotp(key, c) for c in range(4)])
# RFC 6238 test vector: time 59 s, 8 digits, SHA-1 -> 94287082
print('TOTP at t=59, 8 digits:', totp(key, 59, digits=8))
for t in (1_767_225_600, 1_767_225_629, 1_767_225_630):  # 1 Jan 2026 00:00:00 UTC and nearby
    print(f't={t}  window={t // 30}  code={totp(key, t)}')

HOTP counters 0-3: ['755224', '287082', '359152', '969429']
TOTP at t=59, 8 digits: 94287082
t=1767225600  window=58907520  code=745690
t=1767225629  window=58907520  code=745690
t=1767225630  window=58907521  code=119644

Verifiers accept a small window of adjacent time steps to tolerate clock drift, must reject a code that has already been used and must throttle guessing, since a six-digit code has only a million values. The shared secret is the weak point: it exists on both the device and the server, so a server breach can expose every user's seed. OTPs also do nothing against real-time phishing, because the user reads the code from the device and types it into whatever page is in front of them.

Comparing authenticators

Authenticators differ in whether they resist phishing, how they fail and what they cost. SMS and voice codes depend on the telephone network: they can be intercepted or redirected through SIM swapping, number porting fraud and weaknesses in signaling networks, so NIST classes PSTN-based out-of-band authentication as restricted, usable only with extra risk assessment and an alternative offered. Email is not permitted for out-of-band authentication at all. Push notifications are convenient but vulnerable to fatigue attacks; number matching, where the user types a number shown on the login screen into the app, and showing the location of the request reduce this. Smart cards, such as the US government's PIV card or corporate certificate cards, hold a private key on tamper-resistant hardware and prove possession with a challenge-response protected by a PIN.

Phishing resistance has a precise meaning. An authenticator is phishing-resistant when the protocol binds the authentication to the genuine verifier, so that a response produced on a fake site is useless on the real one. FIDO2, which combines the W3C WebAuthn browser interface with the FIDO Client to Authenticator Protocol, does this through origin binding: the browser tells the authenticator which website origin is asking, the authenticator uses a separate key pair for each origin and signs a challenge that includes the origin, and the real site rejects any signature made for a different origin. The user cannot be tricked into producing a valid response for the attacker, because the attacker's site has a different origin. Private keys never leave the authenticator, and the server stores only public keys, so a server breach exposes nothing reusable.

Passkeys are FIDO2 credentials designed for consumers and workforce alike. Synced passkeys are backed up and synchronized across a user's devices through a platform account such as an Apple, Google or Microsoft account or a password manager; device-bound passkeys stay on one security key or device. Synced passkeys solve the recovery problem that kept hardware keys niche, but their security now depends on the account that syncs them. NIST SP 800-63B-4 permits syncable authenticators at AAL2 but not at AAL3, which requires a non-exportable key.

Authenticator assurance levels

NIST defines three authenticator assurance levels. AAL1 gives some assurance using single-factor or multifactor authentication. AAL2 gives high confidence and requires two distinct factors; under revision 4, verifiers must offer at least one phishing-resistant option at AAL2, and US federal agencies must require phishing-resistant authentication for their staff, contractors and partners. AAL3 gives very high confidence and requires a hardware-based, phishing-resistant authenticator with a non-exportable private key, such as a FIDO2 security key or a PIV card. The levels also set reauthentication limits.

In the United States, OMB memorandum M-22-09 directed federal agencies to adopt phishing-resistant multifactor authentication, such as PIV cards and FIDO2, for staff, contractors and partners, and NIST SP 800-63B-4 now writes that requirement into the guidelines. CISA promotes phishing-resistant MFA to the private sector as well, and regulators such as the New York Department of Financial Services require multifactor authentication for access to covered systems.

Biometrics

Biometric systems capture a sample, extract features into a template and compare a new sample with stored templates. In verification, a one-to-one match, the system checks a sample against the template of the claimed identity. In identification, a one-to-many search, it compares a sample against many templates to find who the person is, which is harder and riskier. Biometric characteristics are physiological, such as fingerprint, face, iris, retina, palm vein and hand geometry, or behavioral, such as voice, signature dynamics and keystroke patterns.

Accuracy is measured with two error rates. The false acceptance rate, FAR, also called a Type II error, is the proportion of impostor attempts wrongly accepted. The false rejection rate, FRR, a Type I error, is the proportion of genuine attempts wrongly rejected. Raising the matching threshold lowers FAR and raises FRR. The crossover error rate, CER, also called the equal error rate, is where the two are equal; a lower CER indicates a more accurate system and is used to compare products. In practice, a door to a data center is tuned for low FAR even at the cost of more rejections, while a phone unlock is tuned for convenience. Presentation attacks, such as photos, masks or silicone fingerprints, are countered with liveness detection.

import random
random.seed(5)
# Simulated match scores: genuine users score high, impostors low, with overlap
genuine = [random.gauss(0.78, 0.08) for _ in range(5000)]
impostor = [random.gauss(0.45, 0.09) for _ in range(5000)]
def rates(threshold):
    far = sum(s >= threshold for s in impostor) / len(impostor)
    frr = sum(s < threshold for s in genuine) / len(genuine)
    return far, frr
print('threshold   FAR      FRR')
for th in (0.50, 0.55, 0.60, 0.65, 0.70):
    far, frr = rates(th)
    print(f'  {th:.2f}    {far:6.2%}   {frr:6.2%}')
best = min((abs(rates(t / 1000)[0] - rates(t / 1000)[1]), t / 1000) for t in range(500, 701))
far, frr = rates(best[1])
print(f'Crossover near threshold {best[1]:.3f}: FAR {far:.2%}, FRR {frr:.2%}')

threshold   FAR      FRR
  0.50    28.82%    0.00%
  0.55    12.98%    0.20%
  0.60     4.76%    1.42%
  0.65     1.34%    5.16%
  0.70     0.32%   16.36%
Crossover near threshold 0.624: FAR 2.76%, FRR 2.78%

Biometrics should normally be used to unlock a local authenticator, as when a fingerprint unlocks a passkey on a phone, rather than as a credential sent to a server. In that model the biometric never leaves the device, and the server sees only a cryptographic proof. Central biometric databases create a high-value target, and unlike passwords, a compromised fingerprint cannot be changed.

The law on biometrics

In the United States, there is no general federal biometric privacy law, so state laws govern. Illinois's Biometric Information Privacy Act, BIPA, requires written notice, a written release, a published retention schedule and destruction rules before collecting biometric identifiers, and gives individuals a private right of action with liquidated damages of $1,000 per negligent and $5,000 per intentional or reckless violation. After courts held that each scan could be a separate violation, Illinois amended BIPA in August 2024 so that repeated collection of the same biometric by the same method counts as a single violation per person, and it confirmed that electronic signatures satisfy the written-release requirement. Texas and Washington have biometric statutes enforced by their attorneys general, and comprehensive state privacy laws, such as California's, treat biometric data as sensitive. The FTC has also acted against misuse of facial recognition. Checked October 2026.

Thinking like a manager

The exam wants you to know that multifactor authentication is not one thing. When asked for the best defense against phishing or real-time relay, choose a phishing-resistant method such as FIDO2 or smart cards, not SMS or OTP. When asked about biometrics, know FAR, FRR and CER, and know that privacy law, consent and template protection are part of the decision. And always plan for loss and recovery: an authentication scheme without a secure recovery path pushes users and help desks back to the weakest method.