Comparing Multi-Factor Authentication Methods from SMS and TOTP to FIDO2/WebAuthn and Passkeys: A Qualitative Study of Practitioner Perspectives
DOI:
https://doi.org/10.66395/globeis.19Keywords:
FIDO2/WebAuthn, identity and access management, multi-factor authentication, passkeys, phishing resistance, usabilityAbstract
The escalation of cyber-attacks has intensified the need for stronger multi-factor authentication (MFA), motivating a shift from traditional knowledge- and possession-based factors, such as SMS one-time passwords (OTP) and time-based one-time passwords (TOTP), toward FIDO2/WebAuthn credentials and passkeys. This study qualitatively compares five widely deployed MFA methods, grouped as traditional (SMS-based OTP, TOTP, and push-based authentication) and advanced (FIDO2 security keys and platform biometric authenticators), across four criteria: usability, security, cost, and implementation challenges. Adopting an interpretive qualitative design, the study draws on semi-structured interviews with four identity-and-access-management (IAM) practitioners, analysed through Braun and Clarke's six-phase reflexive thematic analysis. Coding produced an initial framework of 30 codes that was consolidated into four themes corresponding to the study criteria. Practitioners consistently characterised traditional methods as more affordable and broadly familiar but weaker in security and more prone to operational reliability problems, whereas FIDO2 security keys and platform biometrics were described as offering stronger phishing resistance and smoother day-to-day operation at a higher initial and maintenance cost. The study situates these accounts within organisational governance and cross-regional regulatory drivers of adoption and recommends a risk-based migration toward FIDO2/WebAuthn and passkeys.
Downloads
References
1. Abbas, W., Joshua, S. R., Abbas, A., & Lee, J. H. (2025). An end-to-end GSM/SMS encrypted approach for smartphone employing advanced encryption standard (AES). arXiv. https://arxiv.org/abs/2503.18859
2. Abduhari, E. S., Shaik, T. C., Adidul, A. B., Ladja, J. H., Saliddin, E. S., Adin, A. J., Rumbahali, F. A., Sali, A. B., Jemser, J. M., & Tahil, S. K. (2025). Access control mechanisms and their role in preventing unauthorized data access: A comparative analysis of RBAC, MFA, and strong passwords. Natural Sciences Engineering and Technology Journal, 5(1), 418–430. https://doi.org/10.37275/nasetjournal.v5i1.62 DOI: https://doi.org/10.37275/nasetjournal.v5i1.62
3. Abiew, N. A. K., Jnr, M. D., & Banning, S. O. (2020). Design and implementation of cost effective multi-factor authentication framework for ATM systems. Asian Journal of Research in Computer Science, 5(3), 7–20. DOI: https://doi.org/10.9734/ajrcos/2020/v5i330135
4. Acemyan, C. Z., Kortum, P., Xiong, J., & Wallach, D. S. (2018). 2FA might be secure, but it's not usable: A summative usability assessment of Google's two-factor authentication methods. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 62(1), 1141–1145. DOI: https://doi.org/10.1177/1541931218621262
5. Almass, S., & Chowdhary, S. K. (2024). Comprehensive study on cyber security and cyber attacks. In Proceedings of the 1st International Conference on Electronics, Communication and Signal Processing (ICECSP) (pp. 1–6). IEEE. DOI: https://doi.org/10.1109/ICECSP61809.2024.10698540
6. Almeida, L. E., Fernández, B. A., Zambrano, D., Almachi, A. I., Pillajo, H. B., & Yoo, S. G. (2023). One-time passwords: A literary review of different protocols and their applications. In International Conference on Advanced Research in Technologies, Information, Innovation and Sustainability (pp. 205–219). Springer Nature. DOI: https://doi.org/10.1007/978-3-031-48855-9_16
7. Ang, K. W., Chekole, E. G., & Zhou, J. (2025). Unveiling the covert vulnerabilities in multi-factor authentication protocols: A systematic review and security analysis. ACM Computing Surveys. DOI: https://doi.org/10.1145/3734864
8. Angelogianni, A., Politis, I., & Xenakis, C. (2024). How many FIDO protocols are needed? Analysing the technology, security and compliance. ACM Computing Surveys, 56(8), 1–51. DOI: https://doi.org/10.1145/3654661
9. Aramide, O. O. (2023). AI-driven identity verification and authentication in networks: Enhancing accuracy, speed, and security through biometrics and behavioral analytics. Adhyayan: Journal of Management Sciences, 13(2), 60–69. DOI: https://doi.org/10.21567/adhyayan.v13i2.10
10. Arora, S., & Bhatia, M. P. S. (2022). Challenges and opportunities in biometric security: A survey. Information Security Journal: A Global Perspective, 31(1), 28–48. DOI: https://doi.org/10.1080/19393555.2021.1873464
11. Bartłomiejczyk, M., & El Fray, I. (2024). Device risk analysis protocol for SMS-based OTP authentication. IEEE Access. DOI: https://doi.org/10.1109/ACCESS.2024.3445931
12. Bianchi, G., & Valeriani, L. (2023). Time is on my side: Forward-replay attacks to TOTP authentication. In International Symposium on Security and Privacy in Social Networks and Big Data (pp. 109–126). Springer. DOI: https://doi.org/10.1007/978-981-99-5177-2_7
13. Bicakci, K., Varli, F. M., Korkmaz, M. E., & Uzunay, Y. (2026). QES-backed virtual FIDO2 authenticators: Architectural options for secure, synchronizable WebAuthn credentials. arXiv. https://arxiv.org/abs/2601.06554
14. Bindel, N., Cremers, C., & Zhao, M. (2023). FIDO2, CTAP 2.1, and WebAuthn 2: Provable security and post-quantum instantiation. In Proceedings of the IEEE Symposium on Security and Privacy (SP) (pp. 1471–1490). IEEE. DOI: https://doi.org/10.1109/SP46215.2023.10179454
15. Burda, K. (2025). Electronic identification of persons and objects – current status. International Journal of Computer Science and Network Security, 25(6), 1.
16. Clarke, N., & Furnell, S. (2025). Usable authentication: Are we there yet? Computers & Security, 104823. DOI: https://doi.org/10.1016/j.cose.2025.104823
17. Duy, P. T., Minh, V. Q., Dang, B. T. H., Son, N. D. H., Quyen, N. H., & Pham, V. H. (2024). A study on adversarial sample resistance and defense mechanism for multimodal learning-based phishing website detection. IEEE Access. DOI: https://doi.org/10.1109/ACCESS.2024.3436812
18. Eko-Davies, O. (2025). Emerging trends in user authentication tools: Innovations, challenges, and future directions. In Proceedings of the IEEE International Conference on Electro Information Technology (eIT) (pp. 51–55). IEEE. DOI: https://doi.org/10.1109/eIT64391.2025.11103704
19. European Parliament & Council of the European Union. (2014). Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (eIDAS). Official Journal of the European Union, L 257, 73–114. http://data.europa.eu/eli/reg/2014/910/oj
20. European Parliament & Council of the European Union. (2015). Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market (PSD2). Official Journal of the European Union, L 337, 35–127. http://data.europa.eu/eli/dir/2015/2366/oj
21. Ferdous, M. S., Ali, M. Y., Chowdhury, F. R., Nahid, M. A., Ionita, A., & Prinz, W. (2026). A passwordless authentication mechanism for the web using self-sovereign identity. ACM Transactions on the Web. DOI: https://doi.org/10.1145/3778360
22. Ganmati, A., Afdel, K., & Koutti, L. (2025). Deep learning-based multi-factor authentication: A survey of biometric and smart card integration approaches. arXiv. https://arxiv.org/abs/2510.05163
23. George, A. S. (2024). The dawn of passkeys: Evaluating a passwordless future. Partners Universal Innovative Research Publication, 2(1), 202–220.
24. Grassi, P. A., Fenton, J. L., Newton, E. M., Perlner, R. A., Regenscheid, A. R., Burr, W. E., Richer, J. P., Lefkovitz, N. B., Danker, J. M., Choong, Y.-Y., Greene, K. K., & Theofanos, M. F. (2017). Digital identity guidelines: Authentication and lifecycle management (NIST Special Publication 800-63B). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-63b DOI: https://doi.org/10.6028/NIST.SP.800-63b
25. Gupta, S. (2025). Hacking the system: A deep dive into the world of e-banking crime. In Techno-Legal Dynamics of Cyber Crimes in Industry 5.0 (pp. 121–148). DOI: https://doi.org/10.1002/9781394242177.ch7
26. Huseynov, E. (2020). Improving user experience with TOTP hardware tokens by implementing QR codes and HID keyboard emulation. In Proceedings of the IEEE International Conference on Application of Information and Communication Technologies (AICT) (pp. 1–5). IEEE. DOI: https://doi.org/10.1109/AICT50176.2020.9368574
27. Idrus, Z. S. S., Cherrier, E., Rosenberger, C., & Schwartzmann, J. J. (2013). A review on authentication methods. Australian Journal of Basic and Applied Sciences, 7(5), 95–107.
28. Ikram, M., Sentana, I. W. B., Asghar, H., Kaafar, M. A., & Kepkowski, M. (2024). More than just a random number generator! Unveiling the security and privacy risks of mobile OTP authenticator apps. In International Conference on Web Information Systems Engineering (pp. 177–192). Springer. DOI: https://doi.org/10.1007/978-981-96-0576-7_14
29. Jubur, M., Shrestha, P., & Saxena, N. (2025). An in-depth analysis of password managers and two-factor authentication tools. ACM Computing Surveys, 57(5), 1–32. DOI: https://doi.org/10.1145/3711117
30. Kalash, Ghosh, B. C., & Addya, S. K. (2025). Enhancing security in smart contract wallets: An OTP-based two-factor authentication approach. In Proceedings of the International Conference on Distributed Computing and Networking (pp. 211–220). DOI: https://doi.org/10.1145/3700838.3700868
31. Kamaruddin, N. H. C., & Zolkipli, M. F. (2024). The role of multi-factor authentication in mitigating cyber threats. Borneo International Journal, 7(4), 35–42.
32. Karim, N. A., Khashan, O. A., Kanaker, H., Abdulraheem, W. K., Alshinwan, M., & Al-Banna, A. K. (2023). Online banking user authentication methods: A systematic literature review. IEEE Access, 12, 741–757. DOI: https://doi.org/10.1109/ACCESS.2023.3346045
33. Kasse, M. C., & Mboup, E. H. M. (2025). Post-quantum secure authentication protocol based on OTP and TEE. The Journal of Supercomputing, 81(16), 1–33. DOI: https://doi.org/10.1007/s11227-025-08029-5
34. Kaur, K., & Jain, A. K. (2025). A survey on phishing attack taxonomy, detection techniques, datasets, and security measures. Journal of Applied Security Research, 1–52. DOI: https://doi.org/10.1080/19361610.2025.2508726
35. Kavitha, L., Ashwitha, K., Dharshana, P. K., & Elakkiyaa, M. (2025). Wireless locking system through OTP. In Proceedings of the International Conference on Multi-Agent Systems for Collaborative Intelligence (ICMSCI) (pp. 1795–1799). IEEE. DOI: https://doi.org/10.1109/ICMSCI62561.2025.10894609
36. Kim, H., Han, J., Park, C., & Yi, O. (2020). Analysis of vulnerabilities that can occur when generating one-time passwords. Applied Sciences, 10(8), 2961. DOI: https://doi.org/10.3390/app10082961
37. Lassak, L., Pan, E., Ur, B., & Golla, M. (2024). Why aren't we using passkeys? Obstacles companies face deploying FIDO2 passwordless authentication. In 33rd USENIX Security Symposium (pp. 7231–7248).
38. Lyastani, S. G., Schilling, M., Neumayr, M., Backes, M., & Bugiel, S. (2020). Is FIDO2 the kingslayer of user authentication? A comparative usability study. In Proceedings of the IEEE Symposium on Security and Privacy (SP) (pp. 268–285). IEEE. DOI: https://doi.org/10.1109/SP40000.2020.00047
39. Maryniuk, M. D., Dalbo, A., Stanitski, J., & Khan, Y. (2025). Using text messaging to reach, reinforce, remind, and support. ADCES in Practice, 13(1), 16–19. DOI: https://doi.org/10.1177/2633559X241280392
40. Matzen, A., Rüffer, A., Byllemos, M., Heine, O., Papaioannou, M., Choudhary, G., & Dragoni, N. (2025). Challenges and potential improvements for passkey adoption – a literature review with a user-centric perspective. Applied Sciences, 15(8), 4414. https://doi.org/10.3390/app15084414 DOI: https://doi.org/10.3390/app15084414
41. Mitra, A., & Sethuraman, S. C. (2025). Verifiable passkey: The decentralized authentication standard. arXiv. https://arxiv.org/abs/2512.21663
42. Mondal, P. C., & Sarkar, P. P. (2025). A novel risk-based multi-factor authentication approach for card-not-present transactions. International Journal of Research and Innovation in Social Science, 9(3), 3062–3076. DOI: https://doi.org/10.47772/IJRISS.2025.90300240
43. Muir, A., Brown, K., & Girma, A. (2024). Reviewing the effectiveness of multi-factor authentication methods in preventing phishing attacks. In Proceedings of the Future Technologies Conference (pp. 597–607). Springer. DOI: https://doi.org/10.1007/978-3-031-73128-0_40
44. Nallainathan, S. (2021). Analysis onto the evolving cyber-attack trends during COVID-19 pandemic. International Journal of Science and Research, 10(4), 139–144. DOI: https://doi.org/10.21275/SR21403140109
45. Obulose, C., & Agu, P. C. (2024). The future of passwordless authentication: Trends, predictions, and emerging technologies. DOI: https://doi.org/10.2139/ssrn.5146650
46. Ometov, A., Bezzateev, S., Mäkitalo, N., Andreev, S., Mikkonen, T., & Koucheryavy, Y. (2018). Multi-factor authentication: A survey. Cryptography, 2(1), 1. DOI: https://doi.org/10.3390/cryptography2010001
47. Ometov, A., Petrov, V., Bezzateev, S., Andreev, S., Koucheryavy, Y., & Gerla, M. (2019). Challenges of multi-factor authentication for securing advanced IoT applications. IEEE Network, 33(2), 82–88. DOI: https://doi.org/10.1109/MNET.2019.1800240
48. Omotunde, H., & Ahmed, M. (2023). A comprehensive review of security measures in database systems. Mesopotamian Journal of Cybersecurity, 115–133. DOI: https://doi.org/10.58496/MJCSC/2023/016
49. Papaspirou, V., Papathanasaki, M., Maglaras, L., Kantzavelou, I., Douligeris, C., Ferrag, M. A., & Janicke, H. (2023). A novel authentication method that combines honeytokens and Google Authenticator. Information, 14(7), 386. https://doi.org/10.3390/info14070386 DOI: https://doi.org/10.3390/info14070386
50. PCI Security Standards Council. (2022). Payment Card Industry Data Security Standard: Requirements and testing procedures (Version 4.0). https://www.pcisecuritystandards.org
51. Peeters, C., Patton, C., Munyaka, I. N., Olszewski, D., Shrimpton, T., & Traynor, P. (2022). SMS OTP security: Hardening SMS-based two-factor authentication. In Proceedings of the ACM Asia Conference on Computer and Communications Security (AsiaCCS) (pp. 2–16). DOI: https://doi.org/10.1145/3488932.3497756
52. Pietrzak, K. (2020). Delayed authentication: Preventing replay and relay attacks in private contact tracing. In International Conference on Cryptology in India (pp. 3–15). Springer. DOI: https://doi.org/10.1007/978-3-030-65277-7_1
53. Prabha, R. S., Dharaneesh, C. K. V., & Reshekkaesh, K. A. (2025). Bio secure authentication framework. In Proceedings of the International Conference on Electronics, Computing, Communication and Control Technology (ICECCC) (pp. 1–6). IEEE. DOI: https://doi.org/10.1109/ICECCC65144.2025.11064011
54. Qian, Y. (2024). Applying combined one-time passwords to prevent phishing attacks in electronic banking. Journal of Artificial Intelligence and Systems Modelling, 2(4), 32–46.
55. Ravilla, H., Sayal, R., & Kulkarni, P. (2023). Study and analysis of FIDO2 passwordless web authentication. In International Conference on Advances in Computational Intelligence and Informatics (pp. 375–386). Springer. DOI: https://doi.org/10.1007/978-981-97-4727-6_38
56. Reese, K., Smith, T., Dutson, J., Armknecht, J., Cameron, J., & Seamons, K. (2019). A usability study of five two-factor authentication methods. In Proceedings of the 15th Symposium on Usable Privacy and Security (SOUPS) (pp. 357–370).
57. Senapartha, I. K. D., & Nendya, M. B. (2024). Usability evaluation of mobile multi-factor authentication based on face authentication, geolocation and QR code. JITK (Jurnal Ilmu Pengetahuan dan Teknologi Komputer), 10(2), 425–432. DOI: https://doi.org/10.33480/jitk.v10i2.5970
58. Shukla, S., Varshney, G., Singh, S., & Goel, S. (2025). A passwordless MFA utilizing biometrics, proximity, and contactless communication. Information Security Journal: A Global Perspective, 34(6), 633–654. DOI: https://doi.org/10.1080/19393555.2025.2536033
59. Sriman, J., Thapar, P., Alyas, A. A., & Singh, U. (2024). Unlocking security: A comprehensive exploration of biometric authentication techniques. In Proceedings of the IEEE Confluence (pp. 136–141). DOI: https://doi.org/10.1109/Confluence60223.2024.10463322
60. Suleski, T., Ahmed, M., Yang, W., & Wang, E. (2023). A review of multi-factor authentication in the Internet of Healthcare Things. Digital Health, 9, 20552076231177144. DOI: https://doi.org/10.1177/20552076231177144
61. Vorakulpipat, C., Pichetjamroen, S., & Rattanalerdnusorn, E. (2021). Usable comprehensive-factor authentication for a secure time attendance system. PeerJ Computer Science, 7, e678. DOI: https://doi.org/10.7717/peerj-cs.678
62. Yusop, M. I. M., Kamarudin, N. H., Suhaimi, N. H. S., & Hasan, M. K. (2025). Advancing passwordless authentication: A systematic review. IEEE Access. DOI: https://doi.org/10.1109/ACCESS.2025.3528960
63. Zhao, J., He, F., Yang, Y., & Zhang, Y. (2025). Identifying implementation flaws of SMS OTP authentication. IEEE Transactions on Mobile Computing. DOI: https://doi.org/10.1109/TMC.2025.3550883
64. Zou, F., Zhang, Z., & Hu, Y. (2025). OTP-Hunter: An app-based fuzzing framework to discover one-time password vulnerabilities. IEEE Transactions on Dependable and Secure Computing. DOI: https://doi.org/10.1109/TDSC.2025.3593598
Downloads
Published
Issue
Section
License
Copyright (c) 2026 GlobeIS International Journal of Global Information Systems
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
