GUIDE / ADMINISTRATION / IT-PRAXIS

Passkeys, FIDO2, TOTP and security keys – MFA for administrators

Not every multi-factor method offers the same phishing resistance. This guide explains passwords, TOTP, FIDO2 security keys and passkeys from an administrator’s perspective.

PROBLEM→ANALYSE→LÖSUNG→BETRIEB

Password only

A password is a knowledge factor. Once stolen, it can often be used remotely.

TOTP

Authenticator codes are stronger than passwords alone but can still be vulnerable to real-time phishing.

FIDO2

FIDO2 security keys bind authentication to the legitimate website, making credential phishing substantially harder.

Passkeys

Passkeys use modern cryptographic keys and may be synchronized or hardware-bound depending on the platform.

What would I use for admins?

For privileged accounts, prefer phishing-resistant FIDO2 or passkey authentication and maintain a secure secondary recovery method.

Break-glass accounts

Emergency access should not depend on the same infrastructure as normal administration. Recovery codes and spare keys should be controlled and protected offline.

Conclusion

MFA is not one thing. The more privileged the account, the more phishing-resistant authentication should be.

Praxis-Merksatz: Gute Administration besteht aus nachvollziehbaren Schritten, dokumentierten Änderungen, Backups und einem getesteten Rückweg.