Authentication Method

Pros

Cons

Best for

Something you know

Passwords

Passwords remain the most widely used method because they’re simple to deploy and familiar to users.

• – Universal compatibility – works with almost every system.
• – Low cost – no hardware or additional infrastructure required.
• – Easy onboarding – users understand the concept.

• – Weak against attacks – phishing, brute force, and reuse.
• – User burden – complex password policies lead to poor habits.
• – High support cost – password resets are still a major helpdesk drain.

One‑Time Passwords (OTP)

OTPs generate short‑lived codes that users enter alongside a password.

These can be via SMS, Email, Apps or hardware tokens.

• – Stronger than passwords alone.
• – Easy to deploy.
• – No need for specialised hardware (for app‑based OTP).

• – SMS is insecure – vulnerable to SIM swap and interception.
• – User friction – entering codes slows login.
• – Phishable – attackers can trick users into giving codes.

Push Based Authentication

Users approve a login attempt via a mobile app notification.

• – Low friction – no codes to type.
• – Harder to phish than OTP.
• – Good user experience – fast and intuitive.

• – Push fatigue – users may approve malicious prompts.
• – Requires a smartphone.
• – Dependent on internet connectivity.

Something you have

Hardware Tokens

Physical devices that generate or store authentication secrets.

These can be Fast Identity Online security keys, Smart cards or hardware tokens.

• • – Very strong security – resistant to phishing and credential theft.
• – No reliance on mobile phones.
• – Offline operation (for many token types).

• – Cost – purchasing and replacing tokens.
• – Logistics – distribution, loss, breakage.
• – User inconvenience – carrying a device.

Something you are

Biometrics

Authentication based on physical characteristics such as fingerprints, facial recognition, or iris scans.

• – Convenient – nothing to remember or carry.
• – Fast – near instant authentication.
• – Difficult to share – reduces insider risk.

• – Privacy concerns – biometric data is sensitive.
• – Irrevocable – you can’t change your fingerprint if it leaks.
• – Hardware dependency – requires compatible devices.

Passkeys (Modern Passwordless Authentication)

Passkeys use public‑key cryptography tied to a device or platform account (e.g., iCloud Keychain, Google Password Manager).

• – Phishing resistant – no shared secrets.
• – User friendly – no passwords to remember.
• – Fast and seamless – especially on mobile.

• – Ecosystem lock in – cross platform support is improving but not perfect.
• – Device dependency – losing a device requires recovery mechanisms.
• – Still emerging – not all services support passkeys yet.