It's Time to Evolve Authentication Security

Summary

Identity-based attacks and compromised credentials are driving a need for stronger authentication, while security requirements must be balanced against user friction and application sensitivity. The guidance recommends phishing-resistant factors, including smart cards, biometric-capable hardware, FIDO2 with WebAuthn, and Passkeys, while warning against security questions, SMS codes, email TOTP, and password antipatterns. It also advises using strong MFA as a backup, dynamic authentication policies and threat detection, and OAuth 2.1/OIDC through an identity provider, with step-up authentication to maintain assurances during a session. For application integration, the recommended approach is to redirect users to an Okta-hosted Sign-In Widget through vetted OIDC client libraries or Okta SDKs, reducing implementation errors in PKCE and token verification while supporting evolving standards.

Takeaways

1. 1

   FIDO2 with WebAuthn and Passkeys can provide phishing-resistant authentication using biometrics on capable devices, while Passkeys can support credential portability within the same device ecosystem.

2. 2

   Security questions, SMS one-time codes, and email TOTP are discouraged because they are vulnerable to social engineering, SIM swapping, interception, delivery problems, or spam filtering.

3. 3

   Vetted OIDC client libraries or Okta SDKs help avoid implementation errors in PKCE verification and token validation while keeping authentication integrations aligned with evolving OAuth specifications.