There are many types of multi-factor authentication and randomly generated dynamic passcodes. There is time-based and counter-based (aka event-based) and combin

There are many types of multi-factor authentication and randomly generated dynamic passcodes. There is time-based and counter-based (aka event-based) and combination of both. There is also MFA that have and don’t have seed registration. There is MFA for corporate use and different ones for end users. End user MFA often consists of TOTP, HOTP, FIDO U2F, WebAuth and SMS OTP. Each one of these have different security and usability profiles. SMS OTP has the lowest security profile but the broadest reach (no mobile app or token key necessary). Most mobile Authenticator apps support the TOTP and HOTP formats. But few of them are cross-platform and on multiple devices with auto-filling capabilities with an optional integrated password manager and Authenticator like SAASPASS. In addition most Authenticator apps do not have secure backup and restore capabilities. But the weak link in most consumer implementations of MFA is not the MFA but the automated account recovery process that is often susceptible to SIM Swap attacks (you are only as strong as your weakest link - irrespective of MFA usage). The SAASPASS mobile app has a Security Scan function that identifies duplicate and weak passwords and in addition services that have the Authenticator (TOTP/HOTP) format of MFA in the password manager. As for corporates the choices of configurable MFA can vary from (from SAASPASS): Manual OTP (offline supported) Push Login Approval Scan Encrypted Barcode Remote Login 2FA (IoT) Remote Lock 2FA (IoT) Mobile On Device Login Mobile Web URL callback Proximity (offline supported) App to App (with SDK) SAASPASS Connect SAASPASS system offerings: SMS OTP Email OTP 3rd Party Tokens: HOTP tokens TOTP tokens FIDO U2F (offline supported) Yubico OTP Biometric Methods: FaceID - iPhone TouchID - iPhone Fingerprint on Android Facial on Android Facial Authentication (offline supported on-premise) - Corporates should still use Access Control policies (even with the strongest of MFA implementations like Scanning Encrypted Barcodes). Disclosure: I work in the IAM space and a reseller of SAASPASS.