MFA Methods: TOTP vs. FIDO2 vs. Push — Which for SMBs?

In 2026, multi-factor authentication is no longer optional — cyber insurers routinely deny coverage without a documented MFA strategy, and data-protection regulators treat missing MFA on admin accounts as a violation of “state of the art” duties. The real question in mid-sized IT environments is therefore no longer whether, but which method: TOTP codes from an authenticator app, hardware-bound FIDO2 keys, or push notifications to a smartphone.

All three methods solve the same base problem — they prevent a leaked password alone from causing loss of control. In practice, however, they differ massively in phishing resistance, procurement cost, and user acceptance. This article classifies the three methods technically and gives a differentiated recommendation for admin accounts and regular users.

TOTP: the pragmatic classic

Time-based One-Time Passwords per RFC 6238 have been the de-facto standard for “second factor lite” for over a decade. Server and client share a 160-bit secret from which a six-digit code is derived every 30 seconds. Enrollment happens via QR code, the app — Aegis, Ente Auth, 2FAS, or the Bitwarden Authenticator — runs offline on any smartphone.

The strengths are clear: zero hardware cost, universal support from GitHub to your router, works offline and without a cloud account. For SMBs on a tight budget, TOTP is the low-barrier entry point.

The weakness is equally clear: TOTP codes are phishable. An adversary-in-the-middle campaign — Modlishka, Evilginx, or by now off-the-shelf “phishing-as-a-service” kits such as Tycoon 2FA — proxies the login page in real time. The user types password and code on a spoofed domain, the attacker forwards both to the real server within two seconds and hijacks the session. The second factor becomes a fig leaf.

Additionally problematic: enrollment secrets are rarely rotated, sit as QR-code screenshots in some ticket system, and get mailed back to the user on phone replacement. Taking TOTP seriously requires a clean enrollment and recovery process.

FIDO2/WebAuthn: phishing-resistant by design

FIDO2 solves the phishing problem structurally. Instead of a symmetric secret, the standard uses asymmetric cryptography per relying party (domain). The private key never leaves the authenticator — YubiKey 5, Token2 PIN+, Feitian ePass, or the platform authenticators in Windows Hello, Touch ID, and Android Passkey.

The decisive point: the browser signs the challenge together with the calling origin. If the user is on login-datazone.evil.tld instead of login.datazone.de, the authenticator simply refuses to sign. Adversary-in-the-middle fails — not because the user is smart, but because the protocol prevents it. This is why Google, after its mandatory FIDO2 rollout for all employees, no longer reports a single successful phishing attack against accounts consistently switched to security keys (source: Google Security Blog).

The price: hardware. Two keys per user are mandatory (one in use, one in the safe for loss cases), roughly 50–120 EUR per person depending on model. Plus the operational question: what happens on lost key? What does enrollment look like for remote employees who can’t pick up their key in person?

Passkeys — more precisely, discoverable credentials per FIDO2 Level 2 — smooth this process. The authenticator inside the smartphone or notebook acts as a FIDO2 device itself; syncing is optional via iCloud Keychain or Google Password Manager. For SMB daily operations, this means: FIDO2 security without separate hardware, but with trust in the respective platform provider.

Push notifications: convenient, but fragile

Push-based MFA — known from Microsoft Authenticator, Duo, or Okta Verify — works asymmetrically (the push contains no reusable code) and is therefore theoretically more phishing-resistant than TOTP. In reality, the concept fails at the human component: MFA fatigue.

The Uber breach in September 2022 played out exactly this way: compromised password, then an hour of minute-by-minute push requests to the user, in parallel a WhatsApp message “from IT support” asking to please just approve the request. The employee clicks “Accept” out of annoyance — session hijacked, attacker inside the internal network.

Modern push implementations try to counter with number matching (the user has to type a two-digit number from the login prompt into the app) and context display (location, app, IP address are shown). This helps — but does not eliminate the fundamental issue that a tired user will eventually decide wrong.

Direct comparison of the three methods

The following matrix summarizes the key criteria for the SMB decision:

Criterion	TOTP	FIDO2 / Passkey	Push
Phishing-resistant	No	Yes (by protocol)	Partially (fatigue)
Hardware cost per user	0 EUR	50–120 EUR (2 keys)	0 EUR (BYOD)
Offline-capable	Yes	Yes	No
User comfort	Medium (type code)	High (touch)	High (click)
Loss recovery	Backup codes	Second key/passkey sync	Re-enrollment
Enrollment effort	Low	Medium	Low
Cyber-insurer recognition	Basic	Premium	Basic
Recommended for	All users	Admins, priv. accounts	Regular users (with number matching)

Rollout with Authentik or Keycloak

In the Linux infrastructures we support, a central identity provider has become standard — usually Authentik 2025.10 or Keycloak 26. Both handle all three MFA methods natively and can be connected via SAML/OIDC to Nextcloud, GitLab, Grafana, Proxmox VE, TrueNAS SCALE, and OPNsense.

A typical Authentik policy for tiered MFA requirements looks like this:

# Authentik Expression Policy: FIDO2 mandatory for admin groups
if ak_is_group_member(request.user, name="administrators"):
    # Checks whether a WebAuthn device is registered
    return any(
        d.__class__.__name__ == "WebAuthnDevice"
        for d in request.user.mfa_devices.all()
    )
# Regular users: TOTP or push is sufficient
return request.user.mfa_devices.exists()

This policy is bound to an Authentication Flow. Admin accounts without FIDO2 simply can’t get in anymore — not even with the correct password and TOTP delivered. For regular users, TOTP remains the base factor; push can be offered optionally as a comfort option.

Practical rollout sequence we use in customer projects:

1. Week 1–2: Central IdP setup, connect the most important applications via SSO
2. Week 3: FIDO2 mandatory for all accounts with administrative privileges (domain admins, Proxmox root, TrueNAS admin, OPNsense admin, backup accounts)
3. Week 4–6: TOTP enrollment for all standard users with a documented recovery process
4. From week 7: Optional passkey migration for end users who don’t want a physical key

Special case: privileged access

Backup accounts, firewall admin, and hypervisor root are the crown jewels of every infrastructure. Anyone using TOTP or push here has not taken the threat model seriously. For the backup infrastructure and Proxmox root access, our projects apply an uncompromising rule: FIDO2 with two separate hardware keys per person, documented in an emergency runbook.

The reason is simple: once ransomware has phished a domain admin, the backups are within reach minutes later. FIDO2 breaks this chain not through better user education, but through a protocol that simply ignores origin spoofing. That is the only reliable protection against the “last email click” of a stressed colleague.

Conclusion

The pragmatic answer for SMB reality is a tiered model: FIDO2 for all privileged access (non-negotiable), push with number matching for daily end-user login, TOTP as a fallback for systems without WebAuthn support. Anyone without MFA anywhere starts with TOTP across the board and upgrades admin accounts to FIDO2 within 30 days. Pure TOTP deployments for admin roles are no longer defensible in 2026.

The investment in FIDO2 hardware pays off with the first prevented phishing incident — factor 100 or more, once you factor in downtime, forensics, and possible data-protection proceedings.

DATAZONE supports your MFA rollout from threat analysis through selection of the right authenticator hardware to integration with Authentik or Keycloak — including connection of your existing Proxmox, TrueNAS, and OPNsense infrastructure. Get in touch, we will review your current MFA landscape and deliver a solid roadmap.