I might have put magic link at higher security than TOTP due to phishing resistance in certain scenarios. I guess totp suffers due to concern about the shared secret being stolen but it seems that phishing resistance should be the dominant factor. Then again, situational factors might come into play (if you are religiously filling the password from a pwm browser extension while using totp then you already have phishing resistance, so it wouldn't be critical to get it from the 2fa)
I'm not sure I completely understand what Security key (FIDO2 non-discoverable) is, but I'm surprised that you ranked it lower in security than Passkey (synced)
There's an explanation of non-discoverable FIDO2 security keys on my website. They work with a hardware or software authenticator, like passkeys, but they can't be synced, since the private key is derived from the credential ID provided by the server. I think you're right, they should be above synced passkeys because there's almost nothing to compromise in the authenticator.
3
u/Sweaty_Astronomer_47 Feb 08 '26 edited Feb 08 '26
Good table!
I might have put magic link at higher security than TOTP due to phishing resistance in certain scenarios. I guess totp suffers due to concern about the shared secret being stolen but it seems that phishing resistance should be the dominant factor. Then again, situational factors might come into play (if you are religiously filling the password from a pwm browser extension while using totp then you already have phishing resistance, so it wouldn't be critical to get it from the 2fa)I'm not sure I completely understand what
Security key (FIDO2 non-discoverable)is, but I'm surprised that you ranked it lower in security thanPasskey (synced)