← Security
An authenticator app is the best balance of security and convenience for most organisations. SMS is the weakest of the common methods, a hardware token the strongest but most expensive. In practice it is almost always a combination, matched to the group of users.
The five methods
- Authenticator app (TOTP)
- Free, works without a network and more than sufficient for most purposes. The downside: losing the phone requires a recovery procedure.
- Push notification
- Pleasant to use but prone to thoughtless approval. Choose a variant that requires typing a number across.
- Hardware token
- The strongest option and the only one genuinely resistant to phishing. Costs money and administration, and suits high-privilege accounts.
- SMS
- Better than a password alone, but messages can be intercepted and a number moved to another SIM card.
- Certificate
- For machines, integrations and service accounts with no person behind them. Requires managing issuance and expiry.
Choose per group
- Office staff
- Authenticator app, with a fallback for anyone without a company phone.
- Administrators
- Hardware token. These are the accounts that can do the most damage.
- External parties
- Often certificates or a separate environment, so you do not depend on their phone policy.
- Service accounts
- No second factor for someone to type, but keys or certificates.
The technology is the smallest part. What makes a rollout succeed is arranging the exceptions in advance: lost phones, temporary staff and accounts with no person behind them.
More on this →