SMS codes vs passkeys
A look-alike site can relay an SMS code at once, and an attacker can take over a phone number. A passkey signs only for the real site, so a relay or a swap gets nothing. SMS codes let a relay attacker in at 0.2 sign-ins/s and a SIM swap at 0.1 sign-ins/s. Passkeys let in none.
Limit 1/s per account · all codes tried in 12 days
Case 1
40 admins sign in with a second step. A look-alike console relays 0.2 sign-ins/s and a SIM swap adds 0.1 sign-ins/s. No attacker may sign in, and admin p99 must stay below 1 s.
| Measure | Goal | Text message codes | Passkeys |
|---|---|---|---|
| Throughput (Relayed) | none | 0 req/s Fail | 0 req/s Pass |
| Throughput (Swapped) | none | 0 req/s Fail | 0 req/s Pass |
| Availability (Admins) | at least 99% | 99.896% Pass | 100% Pass |
| p99 latency (Admins) | under 1 s | 656 ms Pass | 71 ms Pass |
| Monthly cost | 10 USD/mo | 8 USD/mo | |
| Error rate | 0.1% | 0% |