Glossary
Phishing-resistant MFA
Multi-factor authentication that can’t be phished or relayed, such as passkeys and hardware security keys tied to the real website.
Also called Passkeys, FIDO2, Security keys.
In plain terms
SMS codes and push notifications can be tricked out of people: by a fake login page, a convincing phone call, or a flood of push requests until someone taps “approve”.
Passkeys and security keys are bound to the genuine site and to a device the person holds, so there is nothing for an attacker to talk them into handing over.
See what happens without it
The failure pattern this protects against, weak or phishable authentication on a privileged path, played out step by step.
Scroll the diagram sideways to see every system.
A phone call was the only barrier to admin.
What goes wrong:
- An attacker calls the help desk, pretending to be an employee.
- The help desk resets the password and the SMS code over the phone.
- The attacker signs in to the admin console.
- A phone call was the only barrier to admin.
With the safeguard:
- An attacker calls the help desk, pretending to be an employee.
- Resets require verified identity, so the help desk checks with the real person.
- Admin sign-in needs a passkey on the employee’s own device, so the attempt fails.
- The real employee reports the attempt.
When it mattered
In 2022 an attacker bombarded an Uber contractor with MFA push requests and then posed as IT support until the contractor accepted, gaining access to internal tools.