Choosing the right MFA method for online systems: A comparative analysis

Abstract

A robust authentication method is needed to protect online user accounts and data from cyber-attacks. Using only passwords is insufficient because they can be easily stolen or cracked. Multi-factor authentication (MFA) increases security by requiring two or more verification factors from the user before granting access to a resource such as an online account or an application. MFA is essential to a strong identity and access management (IAM) policy. This study evaluates and contrasts several MFA methods for online systems, including Microsoft Authenticator, FIDO2 security keys, SMS, voice calls, and biometrics. We assess these methods based on four criteria: security, usability, cost, and compatibility. We discover that only some MFA methods excel across the board. The best MFA method will depend on the organization's and users' specific needs and preferences. Each MFA method has benefits and drawbacks on its own. Based on our analysis, we do, however, make some general observations and recommendations, such as preferring FIDO2 security keys and certificate-based authentication for high-security scenarios, choosing Microsoft Authenticator and biometrics for high-usability scenarios, and avoiding SMS and voice calls for low-security and low-usability scenarios.