Although usually generated by a trustable source, an insider attacker could potentially route the code to themselves.Īdditionally, SMS codes often last longer than TOTP codes. SMS-based MFA uses codes similar in structure to those of TOTP, except instead of being generated directly on a smartphone, they’re sent via SMS text message, which means they’re being created outside of the device. Comparing TOTP to Other Popular Forms of MFA SMS-based MFA In comparison to other forms of MFA, however, TOTP is both fairly lightweight and effective. MFA already adds an extra step for users by default, and TOTP can introduce the challenge of inputting the code only for it to expire right before you submit. Regarding end user experience, however, TOTP is sometimes met with consternation. From a security standpoint, TOTP adds a sizable buffer between an organization and a breach. Google Authenticator), so it falls under the “something you have” classification.Īs the name suggests, each TOTP code is only valid for a short amount of time and constantly refreshed, meaning that the perpetrator of a breach would need both a user’s compromised credentials and direct access to their phone in order to take over their account. TOTP MFA codes are generally created via a smartphone app (e.g.

TOTP (Time-based, One-Time Password) is a form of MFA that uses a randomly generated code as an additional authentication token. In practice, each should be individualized and mutually exclusive, meaning that compromising one factor doesn’t compromise the others, thus making the possibility of taking over a user’s account significantly more difficult for a bad actor. These factors are colloquially referred to as “something you have, something you know, or something you are” (e.g., an MFA token, password, or biometric information, etc.).Īdditionally, login time and location can also be used as authentication factors. In fact, Symantec found that 80% of recent breaches could have been prevented with the addition of MFA.īecause of its additional factors, MFA helps to fully authenticate that a user requesting access is who they say they are. Since compromised credentials are the leading source of breaches, an additional layer of security through MFA works wonders. If that credential combo is compromised for any reason, MFA acts as the final barrier between an attacker and their prize: the critical data housed within an organization’s network. MFA (also called two-factor authentication or 2FA) is the practice of requiring additional authentication factors beyond the standard username-password combination most authentication mechanisms require.

There are several types of MFA, but before we talk about TOTP MFA specifically, let’s talk about MFA in general and why it’s so effective at securing user accounts. MFA is one of the most effective security methods for blocking unauthorized account takeovers. This blog post (link takes you to an external page) takes a more detailed look at the security concerns of SMS 2FA.Organizations concerned about identity security need to make multi-factor authentication (MFA) a standard practice for their users. Other channels Twilio Verify supports include push, voice, and email. Most customers end up implementing multiple forms of 2FA, so their users can choose the channel that works best for them.

TOTP has stronger proof of possession than SMS, which can be legitimately accessed via multiple devices and may be susceptible to SIM swap attacks. Increased security compared to SMS 2FA: the secret key input for TOTP is only shared once and the method does not rely on the telephony network, which helps reduce the attack surface.Faster (link takes you to an external page) average time to authenticate.Software based, not dependent on carrier fees or telephony access and deliverability.Standardized (link takes you to an external page) authentication solution.While SMS is an ideal solution for 2FA adoption (link takes you to an external page) and ease of use, TOTP has several benefits including:

Totp authentication