2FA is dead, it just doesn't know it yet
The article argues that traditional two-factor authentication (2FA) is becoming obsolete due to advanced phishing, SIM swapping, and real-time man-in-the-middle attacks. It calls for the EU to prioritize actionable, modern security measures—such as passkeys and hardware-bound credentials—over outdated regulatory approaches that fail to address current threats.
Background
- The article argues that SMS-based and app-based 2FA (two-factor authentication) is no longer secure against advanced phishing attacks like "adversary-in-the-middle" (AitM) proxy attacks, where attackers relay login credentials and session cookies in real time.
- The solution proposed is "passkeys" — cryptographic key pairs stored on a user's device, tied to specific websites, which can't be intercepted or replayed even if a user is tricked into visiting a fake login page.
- FIDO2/WebAuthn is the industry standard behind passkeys, backed by major platforms (Apple, Google, Microsoft). The EU is pushing for stronger authentication under eIDAS 2.0 and PSD3 regulations, but the article claims these efforts still miss the mark by not mandating phishing-resistant, device-bound passkeys.
- The author (Alexander Mikhailian) is a security engineer and activist involved in EU digital policy, writing for a technically literate but policy-concerned audience. The piece is part of a broader debate about whether EU digital identity rules are keeping pace with real-world threats.