TOTP
Time-based One-Time Password (RFC 6238). A six to eight digit code derived from a shared secret and the current time, used by authenticator apps. Phishable, so weaker than passkeys.
TOTP was a real improvement over SMS and is now the most common weak link in an otherwise modern stack, because a code a human reads and types can be relayed by a proxy in seconds. It also carries an enrollment problem: the shared secret is displayed as a QR code that can be screenshotted, backed up, and copied. Keep it as a fallback, not as the target state.
See also: MFA, HOTP, phishing-resistant MFA, passkey, one-time password (OTP)
Related on Start with Identity
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GlossaryCJIS Security Policy
The CJIS Security Policy is the FBI's set of minimum security requirements for anyone who accesses, processes, stores or transmits criminal justice information
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin