Table of Contents
Multi-factor authentication has evolved from a niche corporate security tool to a mainstream necessity, and the pace of change is accelerating. As we outline in our guide to two-factor authentication, today’s standard MFA methods – TOTP codes, hardware keys, and SMS – represent the current state of the art. But the authentication landscape is shifting toward models that are simultaneously more secure and less burdensome for users. This article examines where MFA is heading, what technologies are driving the shift, and what it means for how you protect your accounts.
The fundamental challenge has not changed: proving you are who you claim to be without creating so much friction that people abandon security altogether. What is changing is how that proof is constructed, verified, and maintained throughout a session.
Passkeys and the FIDO2 Revolution
The most significant near-term shift in authentication is the adoption of passkeys, built on the FIDO2/WebAuthn standard. Passkeys represent a fundamental rethinking of the login process – not an incremental improvement to passwords, but a replacement for them.
How Passkeys Work
A passkey is a cryptographic credential stored on your device (phone, laptop, or hardware security key). When you register a passkey with a service, your device generates a public-private key pair. The private key stays on your device, protected by the platform’s secure enclave or TPM. The public key is sent to the server.
To log in, the server sends a cryptographic challenge. Your device signs it with the private key, and the server verifies the signature with the public key. The entire process is:
- Phishing-resistant: The credential is cryptographically bound to the specific domain. A phishing site at a lookalike domain cannot obtain a valid signature.
- Passwordless: There is no shared secret that can be leaked, phished, or brute-forced.
- Biometric-gated: The private key is typically unlocked via Face ID, Touch ID, Windows Hello, or a device PIN – adding a biometric or knowledge factor without requiring the user to manage separate 2FA.
Adoption Trajectory
Passkey support has expanded rapidly. Apple, Google, and Microsoft have all integrated passkey support into their operating systems and browsers. Major services including Google, Amazon, PayPal, GitHub, Best Buy, and eBay support passkey authentication. The FIDO Alliance reports that passkey-enabled sign-ins have grown significantly year over year.
The challenge is the transition period. For the foreseeable future, passkeys will coexist with passwords and traditional 2FA methods. Services cannot drop password support until passkey adoption reaches critical mass, and passkey support across the ecosystem – particularly for smaller services, enterprise applications, and legacy systems – remains incomplete.
Passkeys and Password Managers
Password managers are adapting to store and sync passkeys alongside traditional credentials. 1Password, Bitwarden, and Dashlane now support passkey storage, allowing users to access their passkeys across devices without being locked into a single platform ecosystem.
This is a significant development. Without third-party passkey storage, your passkeys would be tied to Apple’s Keychain, Google Password Manager, or Windows Hello, creating platform lock-in that many users and organizations want to avoid. Password managers that support passkeys become the cross-platform bridge, making passkeys practical for users with mixed-ecosystem devices.
For KeePass-compatible apps like PanicVault, passkey support represents the next frontier in feature development: extending the open-standard, user-controlled model to the post-password era.
Passwordless Authentication
Passkeys are the most prominent example of passwordless authentication, but the broader trend encompasses several approaches:
Magic Links
Email-based authentication where clicking a link in your inbox logs you in. No password required. Services like Slack, Medium, and Notion have used magic links for years. The security depends entirely on the security of the email account – which circles back to the importance of strong 2FA on email.
Push-Based Authentication
Instead of typing a code, the user receives a push notification on a trusted device and approves or denies the login attempt. Microsoft Authenticator, Duo, and Okta all offer push-based flows. The user experience is simpler than typing a TOTP code, and the notification includes context (where the login attempt is coming from) that helps users recognize unauthorized attempts.
The weakness is “push fatigue” or “MFA bombing” – attackers who have obtained a user’s password repeatedly trigger push notifications until the user taps “Approve” out of frustration or confusion. This attack has been used successfully against major organizations. Newer implementations require the user to match a number displayed on the login screen with the push notification, mitigating fatigue attacks.
Certificate-Based Authentication
Used primarily in enterprise environments, certificate-based authentication stores a digital certificate on the user’s device. The certificate proves identity without a password. Smart cards and PIV (Personal Identity Verification) credentials use this approach. While powerful, the infrastructure required (certificate authorities, enrollment processes, revocation management) makes this impractical for consumer use.
Biometric Advances
Biometrics are already a common authentication factor – Face ID and Touch ID are the gating mechanism for passkeys on Apple devices. The technology continues to advance in accuracy, security, and scope.
Current State
Modern biometric systems use sophisticated techniques to prevent spoofing:
- Face ID uses a structured light system (flood illuminator, infrared camera, and dot projector) to create a 3D depth map of the face. It cannot be fooled by photographs or simple masks. The mathematical representation of the face is stored in the Secure Enclave, not on Apple’s servers.
- Fingerprint sensors on modern devices use ultrasonic or under-display optical sensors with liveness detection to prevent silicone fingerprint replicas.
- Iris scanning is used in some Samsung devices and in high-security environments. The iris pattern is unique and stable over a lifetime, and the scanning process includes liveness detection.
Emerging Biometric Modalities
Several biometric technologies are in research or early deployment:
Vein pattern recognition – Infrared imaging of the vein pattern in your palm or finger. The pattern is unique, internal (making it harder to capture surreptitiously than a fingerprint), and detectable only in living tissue (providing inherent liveness detection). Some ATMs in Japan already use palm vein scanning.
Voice biometrics – Analysis of vocal characteristics (pitch, cadence, formant frequencies) for identity verification. Used in some banking phone systems. Vulnerable to increasingly convincing AI voice synthesis, which is driving investment in anti-spoofing measures.
Gait analysis – Machine learning models that identify individuals by how they walk, using accelerometer and gyroscope data from smartphones. Still experimental for authentication purposes but promising as a passive, continuous signal.
The limitation of all biometrics is that they cannot be changed. A compromised password can be reset. A compromised fingerprint cannot. This makes biometrics best suited as one factor among several, not as a sole authentication method. For a deeper exploration of how biometric security is evolving, see our dedicated coverage.
Behavioral Biometrics
Distinct from physical biometrics, behavioral biometrics analyze patterns in how you interact with your device:
- Typing dynamics: The rhythm, speed, and pressure of your keystrokes create a unique pattern. How fast you type, which key transitions are faster or slower, and how long you hold each key are distinctive enough to identify individuals with high accuracy.
- Mouse movement patterns: The way you move your mouse – acceleration, curvature, click patterns – is surprisingly unique. This is already used by some fraud detection systems.
- Touch patterns: On mobile devices, how you swipe, the angle of your finger, touch pressure, and screen region preferences create a behavioral signature.
- Navigation patterns: The sequence in which you interact with an application – which features you use first, how you scroll, how long you spend on each screen – can distinguish legitimate users from attackers who have obtained valid credentials.
Behavioral biometrics are compelling because they are passive. The user does not need to do anything special – the system observes normal behavior and builds a confidence score. If the behavioral pattern deviates significantly from the baseline, the system can trigger additional authentication challenges.
The privacy implications are substantial. Collecting detailed data about how someone types, moves, and navigates creates a surveillance capability that could be misused. The tension between security and privacy in behavioral biometrics is an active area of policy and technical debate.
Continuous Authentication
Traditional authentication is binary: you are either authenticated or you are not. You prove your identity once at login, and then you have full access until the session expires. Continuous authentication challenges this model.
In a continuous authentication system, your identity confidence level is constantly reassessed based on multiple signals:
- Are you still at the same location where you logged in?
- Is the device orientation and movement pattern consistent with normal use?
- Does the typing pattern still match the enrolled user?
- Has the network environment changed (e.g., suddenly connecting from a different country)?
- Are the actions being taken consistent with the user’s historical behavior?
When the confidence level drops below a threshold – because the behavioral pattern changes, the location shifts, or the device appears to have changed hands – the system can require re-authentication. The level of re-authentication can be proportional to the risk: a minor anomaly might trigger a biometric check, while a major deviation might require full multi-factor reauthentication.
Continuous authentication is already deployed in some enterprise security products. Consumer-facing implementations are emerging, particularly in banking apps that monitor transaction patterns and escalate verification for unusual activity.
Zero Trust Architecture
Zero trust is a security model with a core principle: never trust, always verify. In a zero trust environment, no user, device, or network connection is trusted by default, regardless of location or prior authentication.
MFA is foundational to zero trust, but zero trust goes further:
- Every access request is authenticated and authorized, not just the initial login. Accessing a different resource or performing a privileged action may require additional verification.
- Least privilege access: Users receive only the minimum permissions necessary for their current task, and those permissions are continuously reevaluated.
- Device posture assessment: The security state of the device (OS updates, endpoint protection, disk encryption) is checked as part of the access decision. A device that fails posture checks may be granted reduced access or denied entirely.
- Microsegmentation: Network resources are segmented so that compromising one system does not provide lateral access to others.
For individual users, zero trust principles translate to practical habits: using different credentials for different services, not trusting public networks, verifying the identity of people who request sensitive information, and treating every access request as potentially adversarial.
The zero trust model aligns naturally with the evolution of MFA. As authentication becomes more granular, contextual, and continuous, the distinction between “logged in” and “logged out” blurs into a spectrum of trust levels that match the sensitivity of each action.
Decentralized Identity
An emerging paradigm that could reshape authentication is decentralized identity (also called self-sovereign identity). In this model, individuals hold their own identity credentials in a digital wallet, similar to how you carry a physical driver’s license.
Instead of proving your identity by logging into a centralized service (which stores your credentials), you present a verifiable credential from your wallet. The verifier can confirm the credential’s authenticity without contacting the issuer, and you share only the minimum necessary information.
For example, to verify your age for an online purchase, instead of uploading an ID that reveals your name, address, and date of birth, you could present a cryptographic proof that says “this person is over 18” without revealing anything else.
Decentralized identity is still in early stages, with pilot programs in government digital identity (EU Digital Identity Wallet), healthcare, and education. The technical foundations – W3C Verifiable Credentials and Decentralized Identifiers (DIDs) – are maturing. Widespread consumer adoption is likely years away, but the trajectory suggests that the way we prove identity online will look fundamentally different within the next decade.
How Password Managers Are Adapting
Password managers sit at the intersection of all these trends. Their evolution reflects the shifting authentication landscape:
Passkey storage and sync: Password managers are becoming passkey managers, storing FIDO2 credentials alongside passwords and providing cross-platform access. This positions them as the central hub for all authentication methods, not just passwords.
TOTP integration: Many password managers already generate TOTP codes, consolidating the authenticator app function into the password vault. This reduces friction (no separate app to open) but concentrates risk (compromising the vault compromises both passwords and 2FA codes). The trade-off is debated among security professionals, but for most users, the convenience improvement makes 2FA adoption more likely, which is a net security gain.
Biometric unlock: Password managers increasingly use platform biometrics (Face ID, Touch ID, Windows Hello) as the primary unlock mechanism, reducing reliance on the master passphrase for daily use while keeping the passphrase as a fallback.
Breach monitoring: Services like 1Password’s Watchtower and Bitwarden’s data breach reports alert users when their credentials appear in breach databases. This proactive monitoring is a form of continuous security assessment.
Secure sharing: Password managers are adding encrypted sharing features for families and teams, reducing the temptation to share credentials through insecure channels.
What This Means for You Today
The future of MFA is promising, but it is arriving gradually. Here is how to position yourself:
Enable passkeys where available. If a service you use supports passkeys, set one up. You can keep your password and TOTP as fallbacks while the ecosystem matures.
Continue using TOTP and hardware keys. These methods remain the backbone of strong authentication. Hardware keys are already FIDO2-compatible and will work as passkeys on supporting services. For a comparison of current options, see our analysis of hardware security keys vs. TOTP apps.
Keep your password manager current. Choose a password manager that is actively adding passkey support and modern features. The password manager that best adapts to the post-password world is the one that will serve you longest.
Watch for SMS phase-out. Services are moving away from SMS-based 2FA. When a service you use adds TOTP or passkey support, switch to it.
Embrace biometric unlock on trusted devices. Using Face ID or Touch ID to unlock your password manager or approve logins is not security theater – it is a mature, phishing-resistant authentication factor backed by hardware security modules.
Stay informed. The authentication landscape changes faster than most areas of consumer security. Understanding what 2FA is is the foundation, and understanding where it is going helps you make decisions that remain sound as the technology evolves. Following the latest developments in authenticator apps ensures you are using the best available tools.
The trajectory is clear: authentication is moving toward methods that are stronger and easier to use simultaneously. The era of typing passwords and six-digit codes will eventually end, replaced by cryptographic protocols that happen invisibly behind a biometric prompt or a button press. Until that future arrives fully, the best strategy is to use the strongest methods available today while preparing for the transition ahead.
