1 min lesson
MFA and passwordless
In "MFA and passwordless", give a plain answer to "Why are FIDO2/passkeys considered phishing-resistant when TOTP and SMS are not?" Then ground it in one lesson detail.
Step 1 of 2
MFA and passwordlessphishing-resistant by default
Not all factors are equal. SMS and TOTP are phishable; FIDO2/passkeys are phishing-resistant because the credential is bound to the origin and never leaves the device. For a security-forward company, the target is phishing-resistant MFA as the baseline, with weaker factors phased out.
- Factor
- SMS / voice
- Phishing-resistant?
- No - SIM-swap and relay attacks
- Use as
- Last resort, deprecate where possible
- Factor
- TOTP authenticator
- Phishing-resistant?
- No - codes can be relayed
- Use as
- Acceptable fallback, not the goal
- Factor
- Push with number-match
- Phishing-resistant?
- Better - defeats push fatigue
- Use as
- Reasonable interim
- Factor
- FIDO2 / passkey
- Phishing-resistant?
- Yes - origin-bound credential
- Use as
- Baseline target for the workforce
| Factor | Phishing-resistant? | Use as |
|---|---|---|
| SMS / voice | No - SIM-swap and relay attacks | Last resort, deprecate where possible |
| TOTP authenticator | No - codes can be relayed | Acceptable fallback, not the goal |
| Push with number-match | Better - defeats push fatigue | Reasonable interim |
| FIDO2 / passkey | Yes - origin-bound credential | Baseline target for the workforce |
Drive the fleet toward passkeys; keep one phishable fallback only for recovery edge cases.