2FA methods

Comparison: security vs convenience

Comparison

Hardware key (FIDO2/YubiKey) ✓security ●●●●● ease ●●

Protocol-level phishing protection. Needs 2 keys (primary + backup).

TOTP app (Aegis, 1Password)security ●●●● ease ●●●●

Codes generated locally. Immune to SMS interception, but a phishing site can relay the code in real time.

Push approvalsecurity ●●● ease ●●●●●

Convenient but vulnerable to MFA fatigue — repeated prompts until you tap yes.

SMS codesecurity ●● ease ●●●●●

Better than nothing, but SIM-swap and interception make it the weakest 2FA.

Email codesecurity ● ease ●●●●

If the mailbox is compromised, this 2FA is useless. Not a real second factor.

Optimum: hardware key for email/banking/password manager + TOTP for the rest. SMS only when there's no alternative. Save recovery codes offline the moment you enable 2FA.