Pandipedia entry
Research report
Choose the strongest MFA method your service offers
Choose the strongest MFA method the service actually offers. CISA ranks phishing-resistant methods, such as FIDO/WebAuthn security keys or passkeys, highest because they are designed to resist phishing; if the service does not offer one, choose from its available alternatives rather than assuming every account has the same options.[1][2]
- If phishing-resistant MFA is unavailable and the service offers push approval, use number matching if available. CISA recommends it as an interim way to reduce MFA-fatigue attacks, but it is not as strong as phishing-resistant MFA.[3][4]
- Authenticator-app codes are preferable to SMS or voice codes, but they can still be phished; use SMS or voice only if no better option is offered.[5]
This guidance compares sign-in MFA methods; the cited CISA guidance does not cover account-recovery options, so it does not rank them.[6]
Sorry, Pandi could not find an answer.
Let's look at alternatives:
- Modify the query.
- Start a new thread.
- Remove sources (if manually added).