Cleartext

Topic Concept

Phishing-resistant MFA

Authentication a fake site or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site.

Also called: phishing resistance

Official site
cisa.gov

Questions (3) #

  • Are synced passkeys phishing-resistant?Identity

    Yes.

    Verified · Rev. 1

  • How do banks stop OTP bots?Fraud

    Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out.

    Verified · Rev. 1

  • What is phishing-resistant MFA?Identity

    Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site.

    Verified · Rev. 1

Comparisons (3) #

ComparisonSMS OTP vs passkeysComparisonSynced vs device-bound passkeysComparisonTOTP vs push notifications

Glossary #

Phishing-resistant MFA
Authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and security keys are the common examples. SMS codes and authenticator-app codes are not phishing-resistant.
Zero trust
A security model in which no user, device or request is trusted because of its network location. Every access decision is made from identity, device health and context, and re-checked continuously.