BACS publishes five security classes for authentication methods: static secrets should in principle no longer be used, and only session-bound methods resist real-time phishing

BACS published on 2026-10-19 the technology assessment "Sicherheitsklassen für Authentifikationsverfahren, -mittel und -dienste", which sorts authentication methods, tokens and services into the three classes tief (low), mittel (medium) and hoch (high), with mittel and hoch each split further, five classes in all (BACS, 2026-10-19). The scheme follows the NIST authentication assurance levels 1 to 3 with slight adjustments and extends them for resistance to real-time phishing; BACS says the classification gives no basis for formal testing or certification and can serve organisations as a basis for security requirements and recommendations (BACS, 2026-10-19). In the assessment, class tief covers any method whose authentication information is static and identical at every login, such as a password or a cryptographic key, and the class does not rise when the secret travels over TLS; BACS concludes that methods in this class should in principle no longer be used (BACS, 2026-10-19). Class mittel needs authentication information generated anew for each login plus at least one further security feature, and the starred variant additionally needs session binding, which ties the session cryptographically to the authentication information or to the device, network or application; the assessment names TLS channel binding, Device Bound Session Credentials and OAuth DPoP as examples, against session hijacking, real-time phishing and adversary-in-the-middle attacks (BACS, 2026-10-19). BACS says the difference between mittel and hoch lies mainly in the use of additional hardware to store the cryptographic keys (BACS, 2026-10-19). Its annex of examples places a password, a static API key and a secret held in a cookie such as a session ID in tief; a password with an SMS code, a software authenticator app, Kerberos tickets, bearer tokens (SAML, OIDC, OAuth, JWT) and synced passkeys in mittel, the passkeys starred; and hardware OTP tokens, hardware certificates in TLS and FIDO2 without synchronisation or key export in hoch, with a footnote that SMS verification should be used only where no better alternative exists (BACS, 2026-10-19).