A sound multi-factor authentication (MFA) solution verifies a user with distinct factors—or a genuine multi-factor authenticator—protects authentication exchanges, resists replay, and offers a phishing-resistant method. The exact requirements depend on the assurance level and rules that apply to your organization. For a practical baseline, cover important systems with MFA, prioritize high-risk access, and plan a path to phishing-resistant authentication.
What makes authentication multi-factor?
Factors must be distinct within the authentication event. Common factor categories are something you know, such as a password; something you have, such as a cryptographic security key; and something you are, such as a biometric. A solution can use either two separate factors or a single authenticator that combines multiple factors.
As an Amazon Associate I earn from qualifying purchases.
Having a password and a browser cookie does not, by itself, establish two factors. A cookie is not automatically a second factor simply because it is stored separately from the password. NIST SP 800-63B Revision 4 sets out these distinctions for its assurance levels; those levels can help structure an organization’s requirements, but do not make the standard a legal obligation for every private-sector service. Applicable laws, contracts, sector rules, and internal risk policies need separate review.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What do NIST AAL2 and AAL3 require?
NIST SP 800-63B Revision 4 defines Authentication Assurance Levels (AALs). The requirements below describe those levels; they should not be presented as universal legal rules outside the standard’s scope.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Requirement | AAL2 | AAL3 |
|---|---|---|
| Authentication method | A multi-factor authenticator or two separate factors. | Phishing-resistant cryptographic authentication. |
| Phishing resistance | The verifier must offer at least one phishing-resistant option. | Required. |
| Cryptographic key | Authenticators use approved cryptography. | The authenticator’s private key must be non-exportable. Syncable authenticators cannot be used at AAL3 because their private keys are exportable. |
| Replay resistance | At least one authenticator must be replay-resistant. | Required. |
| Authentication intent | Not stated as a requirement in the reviewed AAL2 summary (NIST SP 800-63B Revision 4). | Required. |
| Overall session timeout | No more than 24 hours. | No more than 12 hours. |
| Inactivity timeout | Should be no more than one hour. | Should be no more than 15 minutes. |
NIST uses both mandatory requirements and recommendations. In particular, the AAL2 inactivity timeout is a “SHOULD,” while the overall timeout is a “SHALL”; the AAL3 limits have the same distinction. Use the standard’s precise wording when translating these controls into policy.
Biometrics are not a standalone authenticator
Under NIST SP 800-63B Revision 4, a biometric is used with a physical authenticator or to activate one. A fingerprint or face scan alone is not an authenticator under the standard.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why phishing resistance matters
Phishing resistance is a property of the authentication protocol, not simply a label for a method that feels secure. NIST’s test is whether an impostor verifier can obtain secrets or valid authentication outputs without relying on the user’s ability to spot the deception.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchManually entering a one-time password (OTP) or a code delivered out of band does not meet that definition: a phishing site can relay the code to the real service. These methods may add a factor, but that alone does not make them phishing-resistant.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which MFA methods fit different requirements?
| Method | Phishing resistance | Operational fit and caveat |
|---|---|---|
| FIDO2/WebAuthn security key or platform authenticator | High when correctly supported and configured. Verifier name binding prevents a credential from being used at an impostor domain. | A roaming key connects through a supported interface such as USB or NFC; a platform authenticator is built into a supported device or ecosystem. Confirm service support, device compatibility, and recovery options before rollout. |
| Enterprise PKI smart card | Can be phishing-resistant through cryptographic authentication and channel binding in applicable implementations. | Can suit organizations with mature identity and PKI operations. Provisioning cards and readers, and maintaining that infrastructure, are operational considerations. CISA notes that this option is less widely available and requires mature identity management. |
| App-based number matching | Not equivalent to a phishing-resistant cryptographic protocol. | Can reduce the risk of push fatigue compared with a simple approve-or-deny prompt. CISA recommends it as an interim option when phishing-resistant MFA cannot yet be implemented. |
| OTP or text/email code | Not phishing-resistant when the user manually enters the code. | Codes may be familiar to users, but can be phished or relayed and are weaker options in CISA’s guidance. |
NIST identifies WebAuthn/FIDO2 as an example of phishing resistance through verifier name binding: the authenticator selects a secret based on the authenticated domain name of the verifier. CISA describes both roaming physical tokens and platform authenticators. Neither description establishes that a particular key or device works with every service.
How should an organization set MFA priorities?
CISA recommends broad MFA coverage and a phased approach that addresses the most consequential access first. Use this sequence to turn the goal into an implementation plan:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Inventory systems and accounts. Record existing MFA coverage, enforcement gaps, and services that do not support MFA. Assign each unsupported system an upgrade, integration, migration, or risk-escalation path.
- Secure high-value access first. Prioritize administrators, remote access, email, systems holding sensitive data, and critical services.
- Offer a phishing-resistant method and plan its adoption. FIDO/WebAuthn or enterprise PKI are potential paths, depending on the organization’s services and capabilities. If migration cannot happen immediately, use a stronger interim method such as number matching and maintain compensating controls.
- Test the entire authenticator lifecycle. Include enrollment, binding an authenticator to an account, lost-device handling, recovery, revocation, replacement, and help-desk procedures. NIST includes lifecycle requirements, but there is no single recovery pattern established here for every assurance level; design recovery to match the applicable level and risk.
- Check user and platform fit. Test accessibility, operating-system and service support, multiple-device needs, fallback risks, and vendor dependencies. A successful login on one service does not prove that the method works across all accounts.
- Set session and reauthentication controls. Choose limits appropriate to the applicable assurance level and risk; NIST’s AAL2 and AAL3 timeout values are shown above.
What to verify before deploying security keys
A physical key is not a universal fit. Before selecting or issuing one, check the exact accounts and services in scope, device ports and interfaces, operating-system support, and FIDO2/WebAuthn support. Also decide how users will enroll a replacement or recover access if a key is lost. No particular model or service compatibility has been established here.
MFA raises the difficulty of unauthorized access and reduces risk, but it does not prevent every account takeover. Coverage, secure recovery, session controls, and the resistance of the chosen method all matter.
Quick Recap
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
