Multi-factor authentication blocks most password-only attacks. But adversary-in-the-middle phishing kits relay the real login page, capture the one-time code or session cookie, and log straight in.
What “phishing-resistant” means
FIDO2 security keys and passkeys use public-key cryptography bound to the website’s real domain. A look-alike domain simply cannot request the credential, so there is nothing to steal.
Where to start
- Administrators and finance staff first.
- Email, identity provider and VPN next.
- Keep a secure recovery process — it becomes the new target.
Leave a Reply