Is Two-Factor Authentication (2FA) Still Enough in 2025?

We’ve long believed that using two-factor authentication (2FA) was a strong security measure. But now, in 2025, it’s time to ask ourselves: Is it still enough?

Phishing techniques have evolved significantly. Today’s phishing emails are hard to detect, even for trained users. Attackers are no longer just tricking users — they’re bypassing technical protections we used to trust.

Let’s take DKIM (DomainKeys Identified Mail) as an example. DKIM is designed to verify that the email was actually sent from the domain it claims to be from, using a digital signature. But attackers have found ways to replay valid signatures or steal signed email content, causing the email to pass DKIM checks — and land in users’ inboxes as if it were legitimate.

Sample of DKIM

This makes it much harder for regular users (and even security teams) to detect phishing emails based on email headers or authentication checks alone.

So what about 2FA? Is it still effective?

Authenticator apps are still widely used, and yes, they’re better than passwords alone. But they have their own limitations:

• If your phone is lost or stolen, recovery can be difficult.
• Some users don’t back up their 2FA keys, meaning they could lose access permanently.
• More importantly, some phishing kits are now capable of real-time 2FA token theft, asking users for their codes and immediately forwarding them to the real service (man-in-the-middle attacks).

🗝️ This is why I believe Passkeys are the future.

A passkey is a new type of login credential based on FIDO2/WebAuthn standards. Here’s why they stand out:

• Phishing-resistant: They don’t work on fake websites. If a user is tricked into clicking a phishing link, the passkey simply won’t authenticate the session.
• No server-side passwords: Unlike traditional methods, there’s nothing to steal from a database. Credentials are stored safely on the user’s device.

Biometric-based: Most passkeys are tied to fingerprint or facial recognition, making them easier and safer to use than passwords or OTPs.

• No dependency on phone numbers or SMS: Which reduces the risk of SIM swapping and number theft.

Password Vs Passkey

📌 In short: While 2FA is still important, it’s no longer bulletproof. In today’s threat landscape, we need more advanced, phishing-resistant methods. Passkeys are designed to handle this exact challenge.

Let’s be proactive. The security threats we face won’t wait — and neither should we.