Understanding Different Authentication Methods (And Why SMS Is Not The Best Option)

As technology advances, so does cyberattacks. Hackers find more sophisticated ways to overcome cybersecurity. To protect data and information systems, organizations use authentication.

What It Is

Generally, authentication refers to the process of recognizing user identity. It is often seen at the start of applications.

Different credentials may be involved. These can be categorized into three. 

The first one is knowledge. The application or system will ask for something the user knows. It can be a PIN or a password.

The second category is possession or something that the user has. It can be an authentication application or SMS-based one-time passcode (OTP).

The third type is traits. This one refers to something that verifies who the user is, such as a face scan or fingerprint. 

Different Authentication Methods

For cybersecurity, the best approach is to have multi-factor authentication or what some may know as two-factor authentication. However, only 2.3% of Twitter active users are using this method as reported in the social media company’s Account Security Report.

Among those who said they take advantage of two-factor authentication, 79.6% use SMS-based OTPs. The problem is that SMS is one of the least secure methods of authentication.

It is important to understand that not all multi-factor authentication systems are the same. Some utilize more secure methods than others. To better understand this, it is necessary to get to know some of the authentication methods often used in two-factor authentication.

• SMS-based OTPs: Having SMS-based authentication implements multi-factor authentication. However, it is seen as the least effective when it comes to preventing common cyberthreats and attacks, including SIM swap and phishing. It is also not the most convenient method.
• Authenticator Apps: The user installs an authenticator app, which continuously generates new codes to show proof that the user owns the device tied to their account. While it may be better than SMS, using authentication apps is still open to the risk of getting intercepted through phishing and advanced attacks. 
• Security Keys: These refer to physical authentication devices. The user will connect to their device through Bluetooth, NFC, or USB. The security key will serve as their proof of identity when trying to access an application or website. To ensure maximum protection, having security keys that are up to FIDO standards is the best option. 
• Biometrics: Biometrics refers to a trait unique to the authorized user. It can be a face scan or fingerprints. On-device biometrics that follows FIDO standards do not only offer convenience but also have phishing-resistant technology.

To further improve cybersecurity, organizations and service providers must offer simpler but better authentication options. Then, the next step is for them to convince their users and clients to enable two-factor authentication.