---
title: "It's Time to Evolve Authentication Security"
description: "Identity-based attacks and compromised credentials are driving a need for stronger authentication, while security requirements must be balanced against user friction and application sensitivity. The guidance recommends phishing-resistant factors, including smart cards, biometric-capable hardware, FIDO2 with WebAuthn, and Passkeys, while warning against security questions, SMS codes, email TOTP, and password antipatterns. It also advises using strong MFA as a backup, dynamic authentication policies and threat detection, and OAuth 2.1/OIDC through an identity provider, with step-up authentication to maintain assurances during a session. For application integration, the recommended approach is to redirect users to an Okta-hosted Sign-In Widget through vetted OIDC client libraries or Okta SDKs, reducing implementation errors in PKCE and token verification while supporting evolving standards."
---

# It's Time to Evolve Authentication Security

[Okta](https://yomu.fyi/company/okta) · Alisa Duncan · Aug 6, 2025

**Type:** Explainer

## Summary

Identity-based attacks and compromised credentials are driving a need for stronger authentication, while security requirements must be balanced against user friction and application sensitivity. The guidance recommends phishing-resistant factors, including smart cards, biometric-capable hardware, FIDO2 with WebAuthn, and Passkeys, while warning against security questions, SMS codes, email TOTP, and password antipatterns. It also advises using strong MFA as a backup, dynamic authentication policies and threat detection, and OAuth 2.1/OIDC through an identity provider, with step-up authentication to maintain assurances during a session. For application integration, the recommended approach is to redirect users to an Okta-hosted Sign-In Widget through vetted OIDC client libraries or Okta SDKs, reducing implementation errors in PKCE and token verification while supporting evolving standards.

## Context

Identity-based attacks and compromised credentials threaten privileged systems and sensitive resources. The guidance also addresses the need to balance stronger identity assurance with user friction, recognizing that appropriate requirements vary by application, audience, and data sensitivity.

## Approach / What changed

Use phishing-resistant authentication where possible, provide strong MFA as a backup, configure dynamic authentication policies and threat detection, and delegate identity management to an identity provider supporting OAuth 2.1 and OIDC. Applications should use an Okta-hosted Sign-In Widget through vetted OIDC client libraries or Okta SDKs, and may add step-up authentication for continuing identity assurance.

## Takeaways

- FIDO2 with WebAuthn and Passkeys can provide phishing-resistant authentication using biometrics on capable devices, while Passkeys can support credential portability within the same device ecosystem.
- Security questions, SMS one-time codes, and email TOTP are discouraged because they are vulnerable to social engineering, SIM swapping, interception, delivery problems, or spam filtering.
- Vetted OIDC client libraries or Okta SDKs help avoid implementation errors in PKCE verification and token validation while keeping authentication integrations aligned with evolving OAuth specifications.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [OIDC](https://yomu.fyi/topic/oidc), [Security](https://yomu.fyi/topic/security), [WebAuthn](https://yomu.fyi/topic/webauthn)

- Source: [Okta](https://developer.okta.com/blog/2025/08/06/authentication-identity-security)
- Source URL: https://developer.okta.com/blog/2025/08/06/authentication-identity-security
- Ingested by Yomu: 2026-09-09T08:43:50.727Z

[Read original post](https://developer.okta.com/blog/2025/08/06/authentication-identity-security)