Phishing-Resistant MFA
Multi-factor methods that cannot be relayed or replayed by a phishing site, principally FIDO2 security keys and passkeys. Recommended by NIST and CISA over OTP and push.
The property that makes a method phishing-resistant is origin binding: the authenticator refuses to produce a signature for a domain other than the one that registered the credential, so an adversary-in-the-middle proxy gets nothing usable. Everything a human can read, type, or approve can be relayed, which is why one-time codes and push approvals are not in this category regardless of how they are marketed.
See also: WebAuthn and FIDO2, passkey, AAL, MFA vendors, browser-in-the-browser, MFA fatigue, phishable MFA, authentication policy, SSO enforcement, MFA device
Related on Start with Identity
- GlossaryPasswordless
Authentication without a password as a primary factor. Implementations include magic links, OTP codes, and passkeys. Passkeys are the only passwordless method t
- ReportPhishing-Resistant MFA Support Matrix 2026
54% of 95 business SaaS apps support passkeys or security keys, but only 13% let admins require them, and 60% of apps with a documented SSO plan charge more for
- GlossaryBiometric Authentication
Biometric authentication confirms a person by comparing a live measurement of a physical characteristic, such as a fingerprint or face, against a template captu
- GlossaryFIDO2
FIDO2 is a set of specifications from the FIDO Alliance plus W3C. It combines WebAuthn (the browser API) with CTAP (the client-to-authenticator protocol) to ena
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- CVEWindows stores WebAuthn assertions in cleartext event logs
The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black