The pros and cons of 2FA methods

Secfense meta 2a

The pros and cons of 2FA methods

Recent surveys found that 76% of organizations have experienced phishing attacks and more than 80% of security breaches were caused by phishing and credential theft.

When hackers gain access to your database, they can steal valuable and sensitive information. In 2018, the average cost per compromised record in a data breach was $148 while 60% of small companies that suffer a cyber attack go out of business within 6 months.

Popular among hackers for years, phishing techniques continue to evolve and represent a large portion of cybercrimes that plague organizations large and small.

Did you know that just by gaining access to a few standard accounts or one admin account, hackers can compromise an entire organization?

The biggest challenge faced by most companies is to prevent hackers from gaining access to their systems through end-users (e.g., employees and contractors) by exploiting their login credentials. To do so, organizations need effective ways to verify the identity of those logging into their systems.

Two-factor authentication (2FA) is one of the most effective ways for verifying users’ identities before granting access to your organization’s network and data. Here are how it works and the different types of 2FA:

How 2FA Works and 2FA Methods

Two-factor authentication requires users to enter two pieces of information in order to access an account.

Typically, users will first enter “something they know” (e.g., username and password) and then they’ll be prompted to provide “something they have” (e.g., a code sent to their smartphones) and./or “something they are” (e.g., fingerprints.)

Here are the most common 2FA methods used today:

Security Questions

Users are asked to choose one or more security questions and set up the answers. When they access the system, they have to enter their username/password and then provide the right answers to the questions.

This method is low-cost, easy to set up, and doesn’t require additional devices.

However, many answers to common security questions can be found in public records (e.g., mother’s maiden name) or stolen by hackers using social engineering techniques (e.g., phishing email or spoof website,) which undermines the effectiveness of this method.

SMS Messages

When users need to log into a system, a verification code will be sent via SMS message to their smartphones after they have provided their username and password. They will then enter the code to gain access to the network.

The SMS message is convenient to use and doesn’t require additional hardware since most people have an SMS-capable device and can receive SMS messages at no additional cost.

However, since phone numbers aren’t tied to devices, it’s possible for hackers to circumvent this authentication method without having access to users’ smartphones. In addition, cell phone reception is required for this type of 2FA to work.

Code-Generation Apps

Users will install a code-generating app (e.g., Google Authenticator) on their smartphones or mobile devices. When they need to log into the system, they’ll get a one-time passcode from the app to authenticate their identity.

The codes are refreshed frequently (e.g., every 30 seconds) and generated based on a unique algorithm for maximum security. The secret key is stored on the device so this method works even if the user has no reception and there’s no way for hackers to intercept the code.

However, it’s possible for a hacker to clone the secret key and generate their own secret codes. Not to mention, if a device is lost, runs out of battery, or gets “desync-ed” from the service, users will be unable to log in.


Biometrics is “something you are” – such as facial recognition, voice recognition, and fingerprints. This method is commonly used in systems that require a high-security clearance.
Biometrics is very hard to hack and the level of complexity required to do so is often enough to deter criminals from attempting.
However, the implementation of biometric 2FA is often complicated and costly. Not to mention, once the biometric information is compromised, it’s compromised for the rest of the users’ lives.

Universal 2nd Factor Authentication (U2F)

A standard backed by the FIDO Alliance, U2F authentication is executed via a hardware module, typically in the form of a USB token, that users insert into their desktop or laptop devices to generate a one-time password based on a predetermined algorithm.

Since all the necessary data is stored in the token, cellular reception or Internet connection isn’t required – which can prevent hackers from intercepting the transmissions of a code needed for accessing a network.

This method is also very easy to use. All a user needs to do is to insert the token into a device and press a button.

However, this standard is relatively new and not as widely supported as most other 2FA methods. There’s always the risk that an employee leaves the token in the USB port of a computer, undermining the concept of 2FA.

The Most Secure 2FA Method For Your Organization

There are a variety of factors affecting how a company implements 2FA, such as cost, user adoption, and level of security (e.g., for industry compliance.)

The most secure 2FA method to date is U2F, which is backed by international corporations such as Google, PayPal, Lenovo, MasterCard, Microsoft, Visa, etc.

Besides protecting corporations from email phishing attacks, the technology also ensures that a computer’s browser is indeed communicating with the real website instead of a spoof web page set up by hackers.

As such, U2F has been proven at scale to be the strongest defense against phishing attacks that hijack a web browser session – the “man-in-the-middle” attacks.

Using U2F, none of Google’s 85,000 employees have had their work accounts hacked for over a year by phishing or spearphishing attacks. In addition, FIDO U2F is currently the strongest and GDPR-compliant authentication solution available on the market.

Simply by using a $20 device, organizations can drastically improve their cybersecurity by preventing hackers from exploiting vulnerabilities posed by the sheer number of end-users, the prevalence of social engineering, and the unpredictable factor of human errors and negligence.

Antoni takes care of all the marketing content that comes from Secfense. Read More


We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk



We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director


Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera


Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures

Two-factor authentication is known to be one of the best ways to protect against phishing; however, its implementation has always been difficult. Secfense helped us solve that problem. With their security broker, we were able to introduce various 2FA methods on our web applications at once.

Dariusz Pitala

Head of IT