Phishing-resistant MFA

What is phishing-resistant MFA?

MFA means multi-factor authentication. It asks for two or more factors at sign-in. Phishing-resistant MFA adds one more rule. The proof cannot move to a fake site.

A phishing site tricks a user into sharing a secret. Phishing-resistant MFA gives the attacker nothing to steal or replay.

Why is normal MFA not phishing-resistant?

Many MFA methods still use a shared code. A one-time password (OTP) is one example. A push notification is another. An attacker can capture the code or trick the user.

The user reads a code and types it into a fake site. The attacker then replays the code on the real site. This attack works in real time.

• —OTP codes: a user can type them into a fake site.
• —Push notifications: a user can approve a fake prompt.
• —SMS codes: an attacker can intercept or redirect them.

What makes MFA phishing-resistant?

Phishing-resistant MFA binds the sign-in to the real site and the real device. There is no code for a user to read or type. So a fake site gets nothing useful.

• —The method binds the proof to the correct domain.
• —The method binds the proof to the user device.
• —The method uses no shared code or secret.

What are examples of phishing-resistant MFA?

Standards bodies point to a few strong methods. Each one takes out the shared secret.

• —FIDO2 and passkeys bind a key pair to the domain.
• —Smart cards use a certificate on a physical card.
• —On-device biometrics bind the sign-in to one device.

How does SenseCrypt give phishing-resistant sign-in?

SenseCrypt is a passwordless identity provider (IdP). A user enters no password and no shared code at sign-in. So a phishing attack finds nothing to steal.

A user signs in by face. Face matching runs on-device. The sign-in binds to the device. This binding makes the sign-in phishing-resistant.