IDX·October 19, 2026·2 min read
Passwords leak. They are reused across sites, captured by phishing pages and sold in bulk after unrelated breaches. Multi-factor authentication (MFA) adds a second proof of identity, so a stolen password alone is not enough to log in.
Not all MFA is equal
From strongest to weakest:
- Phishing-resistant methods: hardware security keys and passkeys (FIDO2/WebAuthn). They are bound to the real website, so a fake login page cannot use them. The best choice for administrators and finance teams.
- Authenticator apps with time-based codes (TOTP), or push approvals with number matching. Strong and free, but a determined phishing page can still relay a code in real time.
- SMS codes. Far better than nothing, but vulnerable to SIM swapping and interception. Use only where nothing else is supported.
Where to turn it on first
- Email. Whoever controls email can reset almost every other password.
- Domain registrar and DNS. An attacker who changes your DNS controls your website and your mail.
- Hosting control panels, server access and cloud consoles.
- Banking, payment gateways and accounting systems.
- Remote access: VPN, remote desktop, SSH (use keys plus MFA where possible).
- Everything else that supports it.
Making it stick
- Enforce it, do not just offer it. Optional MFA is enabled by the people who need it least.
- Register at least two methods per person, so a lost phone is not a lockout.
- Store recovery codes securely, not in the same inbox they protect.
- Watch for MFA fatigue attacks: repeated push prompts sent in the hope that a tired user approves one. Number matching prevents most of them.
How IDX helps
We recommend turning on two-factor authentication wherever your accounts support it, starting with email, your domain registrar and your hosting control panel. For servers we manage, our team sets up key-based SSH access and keeps management interfaces off the public internet.
IDX on digital infrastructure
Back to blog →