DataTerminology.comNEW
Multi-factor authentication resistant to credential phishing, typically using FIDO2 security keys or WebAuthn with public-key cryptography.
DESCRIPTION
Phishing-resistant MFA uses asymmetric cryptography and origin binding to prevent credential theft and replay. Implementations include FIDO2 security keys and WebAuthn passkeys that verify the site’s origin and never share secrets. It reduces risks from phishing, push fatigue, and adversary-in-the-middle attacks. Governments increasingly mandate phishing-resistant MFA for high-risk systems. Migration requires user enrollment, device support, and integration with identity providers.
ALTERNATIVE DEFINITIONS
CISA
Phishing-resistant multi-factor authentication refers to authentication that is not susceptible to prompt bombing or adversary-in-the-middle attacks and relies on cryptographic authentication tied to the website’s origin.
Emphasizes resilience to specific phishing attack vectors and origin binding.
NIST SP 800-63B
Phishing-resistant authenticators are subject to verifier impersonation resistance and provide authentication that is resistant to disclosure of authentication secrets to an attacker.
Frames phishing resistance in terms of verifier-impersonation resistance.
FIDO Alliance
FIDO authentication is based on public key cryptography; the user’s private keys never leave their device and are never shared with servers.
Highlights the cryptographic design preventing credential phishing.
RELATED TERMS
Multi-Factor Authentication FIDO2 WebAuthn Passkeys Asymmetric Encryption Risk-Based Authentication Zero Trust OAuth TOTP SMS OTP
COMPETING TERMS
SMS-based MFA TOTP-based MFA
KNOWLEDGE AREAS
Data Security Infrastructure Data Privacy & Compliance
TARGET AUDIENCE
Chief Information Security Officer Security Architect Cybersecurity Engineer DevOps Engineer Application Administrator
EXTERNAL SOURCES
- Wikipedia - Multi-factor authentication
- NIST - Digital identity authentication requirements
- CISA - Guidance on phishing-resistant MFA
- W3C - WebAuthn Level 2 specification
- FIDO Alliance - FIDO2 and CTAP specifications
TOP QUESTIONS
What makes Phishing-resistant MFA different from traditional MFA?
It uses public-key cryptography and origin binding so secrets aren’t phishable. Unlike SMS or TOTP, credentials can’t be intercepted or replayed by attackers.
Category: Comparison
Why is Phishing-resistant MFA increasingly mandated?
Adversary-in-the-middle and push fatigue attacks exploit weaker MFA. Regulators promote stronger authenticators to protect critical systems and personal data.
Category: Relevancy
Which technologies enable Phishing-resistant MFA?
FIDO2 security keys and WebAuthn passkeys implement asymmetric cryptography. They verify site origin and keep private keys on user devices.
Category: Example
What are common mistakes when deploying Phishing-resistant MFA?
Poor user enrollment, limited device support, and fallback to weaker factors. Inadequate training causes lockouts and helpdesk burden.
Category: Mistakes
What risks exist with Phishing-resistant MFA adoption?
Operational friction, lost credentials, and legacy application incompatibility. Mitigate with recovery flows and phased migration.
Category: Risks
How do passkeys relate to Phishing-resistant MFA?
Passkeys are WebAuthn credentials synced across devices. They provide phishing-resistant, passwordless sign-in with strong user experience.
Category: Topic
Do you still need multiple factors with WebAuthn?
WebAuthn can satisfy multi-factor based on authenticator properties. Policy should reflect risk levels and device assurance.
Category: Requirements
What is a competing method for MFA?
SMS-based MFA and TOTP apps are widespread but vulnerable to phishing and interception. Prefer FIDO2/WebAuthn for high-risk systems.
Category: Alternatives
Where should organizations start with Phishing-resistant MFA?
Pilot with high-value applications, ensure device and browser support, and implement credential recovery. Educate users and update policies.
Category: Management