Beyond SMS 2FA: Hardware Keys, TOTP & Passkeys

Why SMS 2FA Is the Weakest Option

Two-factor authentication (2FA) adds a second verification step beyond your password. The most common form — a six-digit code sent via SMS — is better than nothing, but it has well-documented weaknesses:

• SIM swapping: Attackers call your mobile carrier, impersonate you, and convince them to transfer your phone number to an attacker-controlled SIM. Once they have your number, they receive all your SMS codes.
• SS7 vulnerabilities: The telephony protocol underpinning SMS (Signaling System 7) has known flaws that allow interception of SMS messages by sophisticated actors.
• Phishing attacks: Real-time phishing sites can relay your SMS code to the attacker's session in seconds. You enter the code on a fake site; the attacker uses it on the real one before it expires.
• SIM cloning: Physically or through carrier access, an attacker duplicates your SIM.

SIM swapping attacks have targeted cryptocurrency holders, social media accounts, and executives. High-value accounts should never rely solely on SMS 2FA.

TOTP: Time-Based One-Time Passwords

TOTP is the standard behind authenticator apps like Google Authenticator, Authy, Aegis, and Raivo. When you set up 2FA on a site:

1. The site generates a shared secret (a base32-encoded key), usually presented as a QR code.
2. Your authenticator app stores this secret.
3. Every 30 seconds, both the app and the server independently compute a 6-digit code using the same algorithm (HMAC-SHA1) applied to the secret + current timestamp.
4. Because both sides use the same secret and synchronized time, the codes match.

TOTP is significantly stronger than SMS because:

• No carrier involvement — codes are generated entirely on your device
• Codes cannot be intercepted via SS7
• SIM swapping doesn't affect TOTP codes

Remaining weakness: TOTP is still vulnerable to real-time phishing — an attacker can relay your TOTP code within the 30-second window. This is why the most security-conscious users go further.

Best TOTP Apps

• Aegis (Android, open source): Encrypted backup, import/export, best-in-class on Android
• Raivo OTP (iOS, open source): Clean interface, iCloud backup option
• Ente Auth (cross-platform, open source): E2EE cloud backup, works on iOS, Android, and desktop
• Avoid Authy for new setups: While popular, Authy's multi-device sync has been abused in SIM-swap attacks; it also limits export options

Hardware Security Keys

Hardware keys (physical devices like YubiKey, Google Titan Key, or Nitrokey) are the gold standard for 2FA. They use the FIDO2/WebAuthn and FIDO U2F protocols.

How a hardware key works:

1. When you register a key with a site, the key generates a unique key pair for that site. The public key is sent to the site; the private key never leaves the hardware.
2. On login, the site sends a cryptographic challenge.
3. The user touches the key (physical user presence is required).
4. The key signs the challenge with the private key — proving possession.
5. The signature includes the site's origin URL, meaning a phishing site gets a signature for its own origin, which the real server rejects.

This origin binding is the critical differentiator: hardware keys are phishing-proof. A real-time phishing attack cannot relay a valid response because the signature is bound to the site domain.

YubiKey Recommendations

• YubiKey 5 NFC: Most versatile — USB-A, NFC for mobile, supports FIDO2, TOTP, OpenPGP, PIV, and more
• YubiKey 5C NFC: USB-C version for modern laptops
• Security Key NFC: Budget option supporting FIDO2/U2F only (no TOTP or advanced features)

Always buy two keys and register both — one as primary, one as backup stored securely. Losing your only hardware key without registered backup codes can lock you out.

Passkeys: The Future of Authentication

Passkeys are a newer standard built on FIDO2/WebAuthn that eliminates passwords entirely. They use the same public-key cryptography as hardware keys but store the private key in your device's secure enclave (Apple Secure Enclave, Android Strongbox, or a hardware key) rather than a separate physical token.

How passkeys work:

1. When registering, your device generates a key pair. The private key stays in the secure enclave. The public key is registered with the site.
2. To authenticate, the site sends a challenge. Your device unlocks the passkey using biometrics (Face ID, fingerprint) or device PIN and signs the challenge.
3. No password is ever typed or transmitted.

Passkeys offer:

• Phishing resistance: Origin binding prevents relay attacks
• No password to steal or reuse
• Biometric convenience: Authenticate with a fingerprint rather than typing a code
• Sync across devices: Apple Passkeys sync via iCloud Keychain; Google's implementation syncs via Google Password Manager

Passkeys are now supported by Apple, Google, Microsoft, and major sites including GitHub, Shopify, and PayPal. For sites that support them, passkeys are the recommended choice.

Choosing the Right 2FA Method

Method	Phishing Resistant	No Carrier Risk	Recommendation
SMS	No	No	Avoid for important accounts
TOTP App	No	Yes	Good baseline for most accounts
Hardware Key	Yes	Yes	Best for email, finance, identity
Passkey	Yes	Yes	Best when available

For most people: use TOTP for everyday accounts, hardware keys for email, financial, and work accounts, and adopt passkeys wherever the option is available.