Two-Factor Authentication and Identity Security

Two-factor authentication requires a second proof of identity beyond the password. Not all 2FA methods are equally secure. In order from weakest to strongest: SMS OTP: receives a one-time code via SMS. Vulnerable to SIM-swapping attacks where an attacker convinces your carrier to transfer your phone number to their SIM card. In 2021, several Australian startups had their accounts compromised via SIM-swap attacks. Use SMS 2FA only when nothing better is available. TOTP authenticator apps (Google Authenticator, Authy, 1Password built-in): generates time-based codes offline. Not vulnerable to SIM-swapping. The codes rotate every 30 seconds. More secure than SMS, broadly supported. Should be your minimum for any business account. Hardware security keys (YubiKey): a physical USB/NFC device that generates cryptographic proofs. Cannot be phished — even if an attacker has your password and creates a fake login page, the hardware key verification fails because the cryptographic challenge is domain-bound. Yubikey 5 NFC costs $70 AUD. For your highest-value accounts (Google Workspace admin, AWS root, Stripe, Apple Developer), a hardware key is worth it.

Passkeys are the future of authentication and increasingly the present. Apple, Google, and Microsoft have all integrated passkeys into their platforms, and the major services (Apple ID, Google, GitHub, Microsoft, PayPal) now support them. A passkey is a cryptographic key pair. The private key never leaves your device; the public key is stored with the service. Authentication happens through a cryptographic challenge-response — no password is transmitted or stored. Passkeys are phishing-resistant (they're domain-bound, so a fake login page can't use them), credential-stuffing-resistant (there's no password to stuff), and more convenient (Face ID / Touch ID replaces password entry). For BathCheck and ShowerBuddy, implementing passkey authentication via Supabase's forthcoming passkey support (or via WebAuthn libraries) should be on your 2025 roadmap. Your iOS apps can use Apple Passkeys via ASAuthorizationController — this is a significant UX improvement and a genuine security upgrade over password-based auth. Healthcare apps with passkey authentication have a stronger compliance story for NDIS and aged care enterprise buyers.