Phishing-resistant MFA
Multi-factor authentication whose proof is bound to the legitimate domain, such as a FIDO2 key, passkey or smart card, so a fake site can neither relay nor extract it, unlike SMS codes or push prompts.
Phishing-resistant MFA is multi-factor authentication whose second factor can neither be relayed by a fake site nor talked out of the user, because the proof is cryptographically bound to the legitimate domain. Two families meet the definition: FIDO2/WebAuthn authenticators (hardware keys, passkeys) and certificate-based smart cards, known as PIV (personal identity verification) cards in the US federal government. SMS codes, one-time passwords and push approvals do not qualify. An adversary-in-the-middle kit such as Evilginx relays the code in real time and walks away with the session cookie. August 2022: the same campaign hit Twilio and Cloudflare. At Cloudflare, employees typed their passwords into the fake page, but the FIDO2 keys mandated for all staff blocked the login. The next month Uber fell to MFA fatigue: the attacker flooded a contractor with push prompts, then reached him on WhatsApp posing as IT support. The Office of Management and Budget's memorandum M-22-09, in January 2022, made this level mandatory for US federal agencies. On the insurance side, most questionnaires still only ask whether MFA covers remote access, email and privileged accounts. The newer ones distinguish the type of factor, and some underwriters give rating credit for FIDO2 keys on admin accounts. A practitioner's caveat: the key protects the sign-in and nothing else. At MGM Resorts in September 2023, attackers say they got a reset through a single call to the help desk; a recovery path that falls back to SMS turns the key into decoration.
Textbook case, made-up figures: two comparable insureds both declare MFA everywhere. The first uses push approvals; the second uses FIDO2 keys on its 40 admin accounts and passkeys for everyone else. The underwriter works through the phished-admin scenario, which he puts at one chance in ten per year for the first. For the second, a fake page is no longer enough. What remains is a call to the help desk, which the insured says it handles with a video callback and manager sign-off. The underwriter puts the second in a better risk tier, the rest of the submission unchanged.
phishing-resistant MFA, phishing-resistant authentication, hardware security key, passkey
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.