1. Why Knowing Your Password Is Not Always Enough to Log In
If someone knows your ID and password, they appear to be you on the screen. A door that only uses a password opens as soon as that password is known. To stop this, a second key is added. The Information-technology Promotion Agency (IPA) explains that even if an ID and the first password are misused, login is blocked, which helps prevent unauthorized access [2]. The US Cybersecurity and Infrastructure Security Agency (CISA) also states that users with multi-factor authentication enabled are harder to hack. If a password is stolen, the attacker cannot enter if they cannot meet the second condition [3]. However, if the second key is a type very similar to the first password, both might be stolen together. So, what kinds of keys are combined?
2. Three Types of Authentication Keys: Something You Know, Have, and Are
According to the Ministry of Internal Affairs and Communications, things used for authentication fall into three categories [1]. The first is "something you know," represented by passwords. The second is "something you have," such as a smartphone. The third is "something you are," including fingerprints, veins, faces, and irises. Using two or more of these is called multi-factor authentication. This works with a password and a fingerprint, or a password and a smartphone. NIST defines multi-factor authentication as requiring proof that a person possesses and controls two different authentication factors [4]. Entering a password twice is not multi-factor because it repeats the same type. How does the "something you have" smartphone produce the number? Note that NIST SP 800-63B also assumes these three types and requires proof of possession and control of two different factors using a secure protocol for higher assurance levels [4].
3. How a Phone and a Server Make the Same Login Number from a Clock
The number in the authentication app does not arrive at the phone via the internet. It is calculated inside the phone. The basis for this is HOTP, a method decided in December 2005. It uses HMAC to create one-time passwords. It was designed to authenticate using "something you know" and "something you have" (a token). HOTP uses the number of times it has been used (a counter) as material [5]. TOTP, from May 2011, uses time instead of the counter. It takes the current UNIX time (time passed since January 1, 1970), subtracts a set start time, and divides by an interval like 30 seconds to get the HOTP material. The phone and server share the same secret (or a secret derived from it) beforehand. Each calculates the value with the same formula and compares them [6]. Only the number you type during login is sent. For example, with a 30-second interval, one day has 86,400 ÷ 30 = 2,880 intervals. From the same secret, 2,880 different values can be made in a day. Because the number changes every interval, even if someone sees the previous number, they cannot use it in the next interval. What if the phone's clock is slightly off? The RFC notes that 30 seconds was chosen to balance security and usability [6].
4. Why Login Still Works When the Phone's Clock Is Slightly Off
A smartphone's clock can drift slightly. To allow login even if it does not perfectly match the server's clock, the RFC recommends that the verifying side accept values that are off by at most one interval, accounting for communication delay [6]. For a 30-second interval, the RFC recommends accepting values that are off by at most one interval. Some implementations also accept values from the previous and next intervals. If the drift continues, it may be recorded and reflected in future checks. Widening the acceptance range increases the number of valid codes, which is advantageous for attackers. The standard 30-second interval is chosen to balance security and usability [6]. So far, this has been about "something you have." How are fingerprints and faces positioned?
5. Why Fingerprints and Faces Are Not Secrets and Are Used with a Device
Fingerprints and faces seem convenient and safe because you do not forget or lose them. However, NIST states that biometric characteristics are not secrets. Face photos can be found online or taken by cameras without the person knowing [4]. A password is in your head, but your face is outside. Therefore, NIST requires that biometrics not be used alone. They should only be part of multi-factor authentication combined with a physical authenticator (something you have) [4]. This does not mean biometric authentication is dangerous. It means it is not used as a single key. When unlocking a smartphone with a fingerprint, the fingerprint is used in combination with having that smartphone. This is a positioning that avoids using it as a standalone element [4].
6. How SMS Codes, Device Prompts, and Security Keys Compare in Stopping Attacks
In a one-year study by Google, New York University, and UC San Diego (published May 2019), the percentage of attacks prevented varied by the type of second key. This was a study of Google accounts, focusing on prevention rates [7]. SMS codes sent to recovery phone numbers prevented 100% of automated bots, 96% of mass phishing, and 76% of targeted attacks. On-device prompts prevented 100%, 99%, and 90% respectively. Users who used only security keys had zero victims of targeted phishing during the study period [7]. Even among "second keys," SMS prevents 76% of targeted attacks while device prompts prevent 90%. NIST treats out-of-band verification via phone lines (like SMS) as "restricted" and notes it should be reviewed as threats change. It is not banned but used with conditions [4]. So far, these keys involve entering and sending something. Is there a way to avoid sending?
7. What Passkeys Send Instead of Secrets
Passkeys are an authentication method based on the FIDO standard. Authentication information is stored on the device or security key [8]. Because it uses public-key cryptography, the device sends a signature made with its private key after user verification, not a secret like a password. Also, fingerprint or face data stays on the device and is not sent to the server. The server only receives information showing that user verification succeeded on the device [8]. Applying this to the three keys, a passkey combines the device (something you have) and user verification on the device (biometrics or PIN) without sending secrets.
8. How to Find the Second Key in Your Settings and Sort It into the Three Types
With an adult, look for items like "two-step verification" or "passkeys" in the settings of services you use often. You can just look; you do not need to change settings. If you find one, think about whether the second key is something you know, have, or are. Even in the same service, SMS and authentication apps are both "something you have," but the number is made in different places. If you use an authentication app, measure the time until the number changes with a clock. You can check if it switches around 30 seconds. Do not show the number to others. For more information, the Ministry of Internal Affairs and Communications' site is available in Japanese [1]. If you want to read the English original, proceed to RFC 6238 for TOTP [6].