The Problem With “Any MFA Is Good MFA”
Adding a second factor blocks many credential attacks, but attackers adapted. Real-time phishing proxies can capture a password and relay a one-time code to the legitimate service before it expires. Push-notification abuse can also pressure a user into approving a login they did not initiate.
Phishing-resistant authentication is designed so the authentication ceremony is cryptographically bound to the legitimate service. That means the user is not simply typing a reusable secret or transferable code into whatever page happens to be on screen.
What a Passkey Changes
A passkey uses public-key cryptography. The service stores a public key; the authenticator keeps the corresponding private key. During login, the authenticator signs a challenge for the legitimate relying party. The private key is not sent to the website, and a fake domain cannot simply collect a six-digit code and replay it somewhere else.
Passkeys may be stored on a hardware security key, device, or synchronized credential ecosystem depending on the implementation. The user experience can look like a fingerprint, face scan, device PIN, or security-key touch, but the security property comes from the underlying cryptographic protocol and origin binding.
Where to Deploy It First
- Privileged administrator accounts
- Email and identity-provider accounts
- Remote-access and VPN accounts
- Cloud-management consoles
- Password managers
- Finance and other high-impact business workflows
Do Not Ignore Recovery
Strong authentication can be undermined by weak account recovery. If a help desk can reset a phishing-resistant credential after answering easily researched questions, the attacker will target the reset path instead. Recovery should use identity verification appropriate to the account’s impact, and privileged accounts should have especially strict processes.
Migration Without Breaking the Business
Start with administrators and security-sensitive teams, then expand. Keep an inventory of applications that support WebAuthn/FIDO-based authentication, applications that only support weaker MFA, and legacy systems that need compensating controls. Avoid making exceptions permanent simply because migration is inconvenient.
Bottom Line
MFA remains essential, but the strength of the factor matters. Passkeys and other phishing-resistant methods remove an entire category of “type the secret into the attacker’s page” failure. That is a meaningful architectural improvement, not just a usability upgrade.
References
NIST SP 800-63B-4: Authentication and Authenticator Management