# MFA Factors

Detailed reference for all Auth0 multi-factor authentication factors including configuration and implementation guidance.

## Independent Factors

### WebAuthn with Security Keys

Physical security keys providing phishing-resistant authentication.

Supported Standards:
- FIDO2
- WebAuthn
- U2F (backward compatibility)

Compatible Devices:
- YubiKey series
- Feitian keys
- Google Titan
- Other FIDO2-compliant keys

Configuration:
- Enable in MFA settings
- Optionally require PIN verification
- Configure user verification level

User Experience:
- Insert or tap security key
- Enter PIN if required
- Complete biometric if supported

### One-Time Password (TOTP)

Time-based codes generated by authenticator apps.

Compatible Applications:
- Google Authenticator
- Microsoft Authenticator
- Authy
- 1Password
- Any TOTP-compatible app

Configuration:
- Standard 6-digit codes
- 30-second refresh interval
- QR code or manual entry setup

User Experience:
- Scan QR code during enrollment
- Enter 6-digit code from app
- Code refreshes every 30 seconds

### Push Notifications (Guardian)

Mobile app notifications for one-tap authentication.

Requirements:
- Auth0 Guardian app or custom Guardian SDK app
- iOS or Android device
- Internet connectivity

Configuration:
- Enable Guardian factor
- Choose notification service (AWS SNS, FCM, APN)
- Configure application branding

User Experience:
- Receive push notification
- View transaction context
- Approve or deny with one tap

### Phone Message (SMS/Voice)

Verification codes delivered via SMS or voice call.

SMS Verification:
- 6-digit code via text message
- Works with any mobile phone
- Requires phone number verification

Voice Verification:
- Automated call with spoken code
- Fallback when SMS unavailable
- Accessibility consideration

Configuration:
- Enable Phone Message factor
- Configure SMS provider (Twilio, etc.)
- Set voice call as fallback

Limitations:
- SIM swapping vulnerability
- Delivery delays possible
- International coverage varies

### Cisco Duo Security

Integration with Cisco Duo platform.

Requirements:
- Existing Cisco Duo account
- Duo API credentials
- Enterprise plan recommended

Configuration:
- Configure Duo integration
- Set API credentials
- Map Duo policies

User Experience:
- Duo prompt appears
- Use Duo Push, call, or passcode
- Consistent with other Duo-protected apps

## Dependent Factors

### WebAuthn with Device Biometrics

Platform authenticators using built-in device biometrics.

Supported Platforms:
- Face ID (iOS)
- Touch ID (iOS/macOS)
- Windows Hello
- Android Fingerprint

Requirements:
- User verification capability
- Platform authenticator support
- Biometric enrollment on device

User Experience:
- Prompted for biometric
- Face scan or fingerprint
- Seamless verification

Note: Requires independent factor enrolled first.

### Email Verification

One-time codes delivered via email.

Configuration:
- Enable Email factor
- Configure email provider
- Customize email template

User Experience:
- Receive email with code
- Enter code in application
- Limited validity period

Use Cases:
- Backup factor
- Low-security scenarios
- Users without smartphones

### Recovery Codes

Pre-generated backup codes for emergency access.

Characteristics:
- Set of single-use codes
- Generated during enrollment
- User must store securely

Configuration:
- Enable Recovery Codes factor
- Configure code count (typically 10)
- Set regeneration policy

User Experience:
- Receive codes during enrollment
- Download or print codes
- Enter one code when needed
- Each code works once only

Best Practices:
- Encourage secure storage
- Remind users to regenerate after use
- Provide clear usage instructions

## Factor Selection Strategy

High Security Applications:
- WebAuthn security keys as primary
- TOTP as backup
- Recovery codes for emergency

Consumer Applications:
- Push notifications for convenience
- SMS as fallback
- Recovery codes optional

Enterprise Applications:
- Cisco Duo for unified security
- WebAuthn for phishing resistance
- TOTP for compatibility

Mobile-First Applications:
- Push notifications primary
- Device biometrics secondary
- SMS fallback

## Factor Comparison

Security Ranking (highest to lowest):
1. WebAuthn Security Keys
2. WebAuthn Device Biometrics
3. Push Notifications
4. TOTP
5. SMS/Voice
6. Email

Convenience Ranking (highest to lowest):
1. Device Biometrics
2. Push Notifications
3. Security Keys (with biometric)
4. TOTP
5. SMS
6. Email

Phishing Resistance:
- WebAuthn: High resistance
- Push with context: Moderate resistance
- TOTP/SMS/Email: No resistance
