Multi-Factor Authentication: TOTP Mechanics, FIDO2 & WebAuthn

Passwords are fundamentally broken. Users reuse them across multiple sites, create easily guessable variants, and fall victim to phishing lures. Multi-Factor Authentication (MFA) is an identity verification methodology that requires a user to supply two or more independent credentials across different authentication categories before access is granted. Microsoft research indicates that enabling MFA stops over 99.2% of automated account compromise attacks!

The Three Classical Authentication Factors

• 1. Something You Know (Knowledge): Passwords, PINs, passphrases, security questions.
• 2. Something You Have (Possession): Smartphone (TOTP app), hardware security key (YubiKey), smart card.
• 3. Something You Are (Inherence): Biometrics (Fingerprint, Apple FaceID, Iris scan).

Note: Requiring a password plus your mother's maiden name is NOT Multi-Factor; that is simply Two-Step Verification using two items from the same factor (Knowledge).

Why SMS-Based 2FA is Insecure: SIM Swapping

While receiving a 6-digit code via SMS is better than no 2FA at all, security agencies (including NIST) strictly discourage SMS-based authentication for sensitive systems. Attackers execute SIM Swapping: they impersonate the victim, call the telecommunications carrier (e.g. Verizon/AT&T), claim their phone was lost, and trick the customer service rep into porting the victim's phone number to an attacker-controlled SIM card, intercepting all SMS verification codes.

Time-Based One-Time Passwords (TOTP RFC 6238)

Mobile authenticator apps (Google Authenticator, Microsoft Authenticator) operate offline without cellular connectivity using the TOTP algorithm:

// TOTP Formula:
TimeStep = floor( CurrentUnixTimestamp / 30 )
TOTP_Code = Truncate( HMAC-SHA1( SharedSecretKey, TimeStep ) ) mod 10^6

The server and the smartphone share a secret seed key (exchanged via QR code during setup). Every 30 seconds, both devices independently calculate the exact same 6-digit code. Because codes expire every 30 seconds, intercepted codes become useless almost immediately.

The Gold Standard: FIDO2 / WebAuthn Passkeys

Even TOTP codes can be phished by modern reverse-proxy toolkits (like Evilginx). FIDO2 WebAuthn eliminates phishing mathematically using public key cryptography: