I’ve been trying to improve my online accounts’ security and privacy as of late, and one major action I’m able to do for the former is setting up two-factor-authentication on as many accounts of mine as possible. I feel like even my randomized and special character containing 20 character passwords …

In full disclosure, I haven’t read your full post but only your title You don’t need to be this paranoid for any reason Simply use your password managers 2FA feature or Ente Auth. It’s not that complicated.

[image] ame: but you’re telling me I can input my e-mail address and then sent the website the saved passkey and skip any password and 2FA input? If you’re setting up Passkeys like this, it isn’t 2FA. It’s more secure 1FA than passwords, but it is still 1FA. If you set up Passkeys or hardwar…

Thank you for your clarification and ranking! I’ve mentioned 1FA passkeys as I’ve seen some services allow passkeys as a replacement for password + 2FA via TOTP/SMS, most prominently Google. [google-login-screen-obfuscated] It seems like I should aim to replace TOTP codes in favor of passkeys wh…

For my own clarification, if the passkey is behind a PIN, is that 2FA? For the passkeys on my Yubikey I need to enter a PIN (something I know) before unlocking the passkey (something I have).

That Yubikey PIN is used for your Yubikey, not your account. Therefore, it shouldn’t be considered 2FA. Another example would be unlocking your phone to view your TOTP code or use your passkey. If they are your only method of authentication, it would still be 1FA even if the phone is protected by a…

In terms of theoretical security In terms of phishing protection I don’t think these should be separated this way as phishing protection is part of security. [image] jonah: In terms of theoretical security: Password + Passkey (2FA) > Password + TOTP (2FA) > Passkey (1FA) >> Password (1FA) …

[image] jonah: Password + Passkey (2FA) > Passkey (1FA) A password offers no phishing resistance. A password + passkey is therefore just as phishing resistant as simply using a passkey. [image] jonah: (which are guaranteed to never be cloned) This simply isn’t true and even if it was …

[image] jonah: Passkey (1FA) This is FUD. Passkeys are MFA, not 1FA. Factors are not counted as the number of items you have to provide for access, but in terms of the type of items you have to provide for access. [image] jonah: Password + Passkey (2FA) > Password + TOTP (2FA) > Passkey …

[image] anonymous210384: Passkeys are MFA, not 1FA. Depends on how the Passkey is secured. If it’s just something you have, then that is one factor. If it’s something you have + something you know (PIN/password) or something you are (biometrics) then it’s 2FA, like I said above.

Privacy Guides Community

What is the most secure 2FA method?

Questions

jonah (Jonah Aragon) May 15, 2025, 4:31pm 7

In the case of Yubikey (which are guaranteed to never be cloned) I would agree that it is 2FA, if the PIN is required for every use.

Software passkeys are in a decrypted state or backed up in various ways too often to rely on this.

Topic		Replies	Views
Should I use my password manager for storing TOTP codes? Questions	24	6970	January 13, 2024
2FA best practices? Questions software	13	2142	October 14, 2024
Storing TOTPs in a Password Manager Questions	1	452	August 24, 2023
2FA email verification setup Questions	3	187	December 13, 2025
TOTP Apps vs Windows Hello Passkeys for 2FA Questions please-eli5	13	369	May 13, 2026

Privacy Guides

Massive organizations are monitoring your online activities. Privacy Guides is your central privacy and security resource to protect yourself online.

Privacy Guides is a non-profit, socially motivated website that provides information for protecting your data security and privacy.

We do not make money from recommending certain products, and we do not use affiliate links.

Knowledge Base

Private Web Browsers

Top VPN Providers

Privacy-Respecting Services

Software Recommendations

More Resources

What is the most secure 2FA method?

Related topics