Two-factor authentication stops many attacks that steal only passwords, but not all second factors resist the same attacks. The two common choices are time-based one-time passwords (TOTP) from an authenticator app, and hardware security keys that use FIDO2 and WebAuthn. This article compares them on the property that matters most against modern phishing: whether a stolen code or response is still useful to an attacker.
How TOTP works
TOTP, defined in RFC 6238, derives a short numeric code from a shared secret and the current time. Most services use six digits that change every 30 seconds. The server and your authenticator app both hold the secret, and both compute the same code. The security rests on the secret staying secret and on the code being used before it expires.
The weakness is that a code is a string that you type. Anyone who receives the string can enter it. A phishing site can show you a copy of the login page, collect your password and code, and relay both to the real service within the 30-second window. Reverse-proxy phishing kits automate exactly this. The attacker then holds a valid session cookie, and the second factor did nothing useful after the fact.
How FIDO2 works
FIDO2 combines the WebAuthn browser API with the CTAP protocol to talk to hardware authenticators. When you register a security key, the key generates a key pair for a specific relying party, identified by its domain. The private key never leaves the device. To log in, the server sends a challenge, the key signs it, and the browser includes the origin it was talking to in the signed data.
That origin binding is the difference. The browser will not offer a credential to a site outside the domain it was registered for, and the signature covers the origin. A phishing site on a look-alike domain cannot obtain a usable response, even if you are fooled into trying. Nothing has to be typed, so there is no code to relay.
Comparison
| Property | TOTP app | FIDO2 security key |
|---|---|---|
| Resists real-time phishing | No. Codes can be relayed | Yes. Origin-bound signatures |
| Requires typing a code | Yes | No, touch only |
| Cost | Free, uses a phone or desktop app | Requires buying a hardware key |
| Works without network on the device | Yes | Yes |
| Recovery if lost | Backup codes, or restore the app's backup | A second registered key, or backup codes |
| Protects IMAP and SMTP logins | No, these use app passwords | No, these use app passwords |
The part people miss: mail clients
Neither factor protects IMAP, POP, or SMTP logins in a typical mail client. Those protocols do not run a browser, so they cannot perform a WebAuthn challenge. ITProMail uses app passwords for clients for that reason. An app password is a long random credential created for one client. Treat it as a password: keep it unique, store it in a password manager, and revoke it when a device leaves your control. Account > Security lists app passwords, and an account can hold up to 20.
This means the second factor protects the webmail login and account settings, which is where an attacker would change forwarding, filters, or recovery options. It does not protect an app password already stored on a stolen laptop. Review the list of app passwords and active sessions periodically.
What to do in practice
- Register a FIDO2 key on your ITProMail account, then register a second key and store it separately. A single key is a single point of failure.
- Keep backup codes somewhere offline and secure.
- If you use TOTP, treat it as a fallback for devices without a key, rather than the only factor on a high-value account.
- Review Account > Security regularly, and revoke sessions you do not recognise.
For setup steps, see the guides for FIDO2 keys and TOTP. If you lose both factors, see account recovery. Two-factor authentication does not stop malware running on your device, so keep the device itself updated and locked.