Proving it’s really you: MFA, passkeys, biometrics and single sign-on

Passwords have one fatal flaw: anyone who learns them becomes you. They are guessed, reused, leaked in breaches and typed into fake login pages. Identity verification is about adding proof that is much harder to steal. This lesson covers the four tools you will meet most often: multifactor authentication, passkeys, biometrics and single sign-on.

Multifactor authentication: two different kinds of proof

Multifactor authentication (MFA) combines factors from different categories: something you know (a password or PIN), something you have (a phone, a security key) and something you are (a fingerprint or face). The point is independence: a password stolen in a breach does not give the attacker your phone. CISA describes MFA as one of the most effective ways to protect accounts and urges everyone to enable it on email, banking and work accounts first.

Not all second factors are equal. From weakest to strongest, the common options are:

• Codes by SMS: better than nothing, but vulnerable to SIM-swap fraud and to fake login pages that relay the code in real time.
• Authenticator apps (time-based codes): not tied to your phone number, but a convincing phishing page can still ask you to type the code and use it immediately.
• Push approvals: convenient, but open to “MFA fatigue”, where an attacker sends request after request until the tired user taps Approve. Number matching reduces this.
• Security keys and passkeys (FIDO2 / WebAuthn): phishing-resistant, because the key only answers the genuine website it was registered with.

Passkeys: logins that can’t be phished

A passkey replaces the password with a pair of cryptographic keys. The private key stays on your device, protected by the Secure Enclave on Apple devices, and never leaves it; the website stores only the public key. When you sign in, your device proves it holds the private key by signing a challenge, after you unlock it with Touch ID, Face ID or your device passcode. Apple’s platform security guide explains that passkeys are bound to the website’s domain, so a look-alike phishing site simply cannot receive a valid answer.

Passkeys also remove the breach problem: there is no reusable secret on the server to steal. If your provider supports them, they are the strongest everyday option available today, and on Apple devices they sync end to end encrypted through iCloud Keychain.

Biometrics: convenient, but local

Fingerprints and faces are excellent for unlocking a device you hold. On a Mac or iPhone, Touch ID and Face ID data is stored and matched inside the Secure Enclave, and Apple states that the biometric data itself does not leave the device. What the website or app receives is not your fingerprint, but a yes from the device, often as part of a passkey or keychain unlock.

Biometrics have limits worth knowing. You cannot change your fingerprint if it is ever copied, and a biometric check only proves who is holding this particular device. That is why they are used as a local unlock step rather than as a password sent across the internet. FireAI follows the same pattern: when you activate a licence, macOS asks you to confirm with Touch ID or your password, and the fingerprint never reaches FireAI.

Single sign-on: one strong login, many services

Single sign-on (SSO) lets you sign in once to an identity provider, then reach many applications without new passwords. Behind it are standards such as SAML and OpenID Connect: the application trusts a signed statement from the identity provider saying who you are. For organisations, SSO is a major security win: one place to enforce MFA, one place to disable an account when someone leaves, and far fewer passwords for people to reuse.

The trade-off is concentration. The identity provider becomes a single point of failure: if an attacker takes over the SSO account, they reach everything behind it. That is why SSO accounts deserve the strongest MFA available, careful session lifetimes, and monitoring for unusual sign-ins. OWASP’s SAML guidance also warns that the applications must validate those signed statements correctly, or the whole scheme can be bypassed.

What to do today

1. Turn on MFA for your email first: whoever controls your email can reset almost everything else.
2. Switch to passkeys wherever a service offers them.
3. Replace SMS codes with an authenticator app or a security key where you can.
4. Never approve a login request you did not start, however many times it asks.
5. In an organisation, put every application behind SSO and require phishing-resistant MFA for it.