Comparing Multi-Factor Authentication Methods

I made a nice little chart comparing multi-factor authentication methods from a user standpoint. Despite some of the information in the chart being slightly subjective and depending on one’s threat model, I still think it’s useful. So here it is:

Multi-Factor Authentication Chart

+----------------+----------------+-----------------+-------------+--------------+----------------+-------------+-------------------+
| Authentication |   Risk-Based   |    Biometric    | Email Token |   Hardware   |    Security    |  Text Codes |     Time-Based    |
|     Methods    |                |                 |             | Security Key |    Questions   |             | One-Time Password |
+----------------+----------------+-----------------+-------------+--------------+----------------+-------------+-------------------+
|    Security    |     strong     |      strong     |     fair    |    strong    |      weak      |     weak    |       strong      |
+----------------+----------------+-----------------+-------------+--------------+----------------+-------------+-------------------+
|  Personal Data |    behavior    |   fingerprint,  |    email    |     none     |  personal life |    phone    |        none       |
|    Exposure    |    patterns,   |    signature,   |   address   |              |     details    |    number   |                   |
|                |  device info,  |    iris scan,   |             |              |                |             |                   |
|                |  access time,  |       etc.      |             |              |                |             |                   |
|                | location, etc. |                 |             |              |                |             |                   |
+----------------+----------------+-----------------+-------------+--------------+----------------+-------------+-------------------+
|    Pitfalls    |    can block   |  can be stolen  |    can be   | easy to lose |     can be     |    can be   |  must be updated  |
|                |   user access  |    or legally   | intercepted |              |   discovered   | intercepted |   if the online   |
|                |   by accident  |    coerced by   |  in transit |              | by information |   via SIM   |     service is    |
|                |                | law enforcement |             |              |    gathering   |   swapping  |    compromised    |
+----------------+----------------+-----------------+-------------+--------------+----------------+-------------+-------------------+

Conclusion

In terms of security, any of these options is better than nothing. But if you want maximum security with the least personal data exposure, just go with hardware security keys or time-based one-time passwords. Other authentication methods are either not very secure or they collect personal information.