The Authentication Ladder

Multi factor authentication is good advice that has been repeated so often it has become vague. Not all of it is equivalent, and the differences decide whether you are protected against the attack you are actually likely to face.

Here is the ladder, and the only column that really separates the rungs is the third one.

Method	Stops a leaked password	Stops real time phishing	Verdict
Password only	No	No	Treat as already public
Password plus SMS code	Yes	No	Better than nothing, and SIM swapping is cheap
Authenticator app code	Yes	No	Decent, still phishable
Push approval with number matching	Yes	Partly	Good
Passkey or hardware security key	Yes	Yes	The one to aim for

Why codes fail against real time phishing

Most people picture phishing as a page that harvests your password for later use. If that were all it did, a six digit code would defeat it, because the code expires in thirty seconds.

Modern phishing does not work that way. The fake page is a live relay sitting between you and the real service.

Walk through it. You land on the fake page and enter your password. The attacker's system immediately submits that password to the real service. The real service issues a genuine challenge for your second factor. The fake page shows you that challenge. You enter your six digit code. The attacker relays it to the real service within seconds. The real service, entirely correctly, accepts it and issues a valid session.

Your code was genuine. It was used inside its validity window. It simply went to the wrong place first.

This is a relay, and it defeats every method in the table whose second factor is something you can read and retype. That includes SMS codes and authenticator app codes, which together account for most multi factor authentication in use today.

Session theft, and the step people forget

The attacker in that scenario now holds something more durable than your password: a session token, the piece of data your browser stores so you are not asked to log in on every page.

That token is what actually keeps you signed in. It was issued after a fully successful authentication, so it is valid, and it typically remains valid until it expires or is explicitly revoked.

The consequence catches out almost everyone: changing your password does not necessarily end an existing session. You reset the password, feel that the problem is solved, and the attacker remains signed in.

The action you need is the one labelled something like "sign out of all devices" or "revoke active sessions" in account security settings. Find it now, on your main accounts, so you are not searching for it under pressure. This is why Module 6 lists it as a distinct step rather than folding it into the password reset.

Why a passkey is different in kind

A passkey is not a better password or a more convenient code. It is a different mechanism, and the difference is what makes the phishing attack unavailable rather than merely harder.

When you create a passkey, your device generates a pair of cryptographic keys. The private key never leaves your device and is never transmitted. The service stores only the public half. To sign in, the service sends a challenge, your device signs it with the private key, and the service verifies the signature.

The critical property is that the signature is bound to the exact domain name of the real service. Your device will only sign a challenge for the site the passkey was registered with.

Now run the relay attack against it. The victim lands on a lookalike domain. The attacker relays a challenge from the real service. The victim's device examines the domain it is actually talking to, finds it does not match, and refuses to sign. There is nothing for the victim to read out, retype or approve, so there is nothing for the attacker to relay.

The user does not need to notice the fraudulent domain. The check happens in software, correctly, every time, regardless of how convincing the page looked or how tired the user is.

This is the property Module 2 called a detection independent control, and it is the reason passkeys matter more than any other single recommendation in this course.

📅 Timeline

You enter your password on a convincing fake pageThe attacker's relay immediately submits it to the real service.

The real service issues a genuine second factor challengeThe fake page displays that challenge to you.

You type your six digit codeThe attacker relays it within the validity window.

The real service accepts and issues a sessionEverything it saw was correct, so it behaves correctly.

The attacker captures the session tokenThey remain signed in even after you later change your password.

With a passkey insteadYour device refuses to sign for the wrong domain, and the sequence never starts.

SMS codes get criticised heavily, and the criticism is fair, but the conclusion people draw from it is sometimes wrong.

The weaknesses are real. SIM swapping is the main one: an attacker persuades a mobile operator to transfer your number to a device they control, using social engineering against the operator's support staff rather than against you. Once they hold the number, they receive your codes. This is a mature, inexpensive service, and it is used routinely against people with valuable accounts. Beyond that, SMS travels through signalling infrastructure with known weaknesses, and codes appear on lock screens where anyone nearby can read them.

Underneath all of it is a design problem: a phone number was never intended as proof of identity. It is a routing address, it is transferable by design, and the transfer is authorised by a third party you have no control over.

So SMS should not protect your email, your banking, or anything that would seriously hurt you.

But the nuance matters. If the alternative on offer is a password alone, SMS is a substantial improvement, because it defeats the single most common attack of all: an automated tool testing a password leaked from an unrelated breach. That attack has no human attention behind it and no ability to intercept a message. SMS stops it completely.

The correct position is therefore ordered rather than absolute. Use a passkey where offered. Use an authenticator app where passkeys are not available. Use SMS only where nothing better exists, and prioritise moving your highest value accounts off it first. Refusing SMS on principle while leaving an account protected by a password alone is worse on every dimension.

❓ Knowledge Check

A colleague enters their password and their authenticator app code into a convincing fake login page. An hour later they change their password. Are they safe?

📚 Flashcards1 / 6

Term

Relay phishing

Click to flip

Definition

A fake login page that forwards credentials to the real service in real time, so one time codes are used inside their validity window. Defeats every second factor you can read and retype.

Click to flip back

💡Key Takeaway

Not all multi factor authentication is equivalent, and the column that matters is whether it survives real time phishing. Anything you can read and retype, SMS and authenticator codes included, can be relayed to the real service while you wait. The attacker then holds a session token, which is why a password change alone leaves them signed in and why revoking sessions is a separate step. A passkey breaks the attack outright, because the signature is bound to the real domain and your device simply refuses to produce one for a lookalike. No user vigilance required, which is exactly the point.