7.1. Securing Accounts: 2FA and Passkeys
An account is only as secure as its weakest sign-in method, and GitHub gives you two distinct ways to strengthen that — the exam wants you to know they aren't the same thing.
💡 First Principle: Two-factor authentication (2FA) adds a second verification step on top of a password — typically a time-based code from an authenticator app — so a stolen password alone isn't enough to sign in. A passkey takes a different approach: it's a phishing-resistant credential built on device-based public-key cryptography that can replace the password entirely, rather than supplementing it. Because a passkey never transmits a shared secret that a phishing site could capture, it closes a category of attack that even 2FA doesn't fully prevent.
| 2FA (authenticator app) | Passkey | |
|---|---|---|
| Replaces password? | No — supplements it | Can replace it entirely |
| Phishing-resistant? | Partially | Yes |
| What it requires | Password + a time-based code | Device-bound cryptographic credential |
⚠️ Exam Trap: 2FA and passkeys are not the same security feature under two names. 2FA is a second factor added to a password; a passkey is a phishing-resistant credential that can replace the password step altogether.
Reflection Question: A user's password is captured by a convincing phishing site. If their account uses 2FA with an authenticator app, is that alone guaranteed to stop the attacker? What about a passkey?
