Phishing-Resistant Authentication — Technology Wiki

Overview

Direct Answer

Phishing-resistant authentication uses cryptographic mechanisms that bind credentials to a specific legitimate service, preventing attackers from harvesting and reusing credentials on fraudulent sites. Standards such as FIDO2 and WebAuthn exemplify this approach by leveraging public-key cryptography rather than shared secrets.

How It Works

The authentication flow uses asymmetric cryptography where a private key remains on the user's device and never transmitted. During registration, the service receives only a public key. At login, the device cryptographically signs a challenge that includes the service's origin (domain); an attacker's phishing site cannot forge a valid signature because it cannot access the private key or produce a signature matching a different origin.

Why It Matters

Organisations face escalating costs from credential compromise and account takeover. Unlike passwords and SMS one-time passcodes, origin-bound credentials eliminate the attack surface for phishing exploitation, reducing both breach risk and incident response overhead whilst improving user experience by eliminating memorisation burdens.

Common Applications

Enterprise single sign-on systems, financial services platforms, cloud infrastructure access, and government identity verification programmes increasingly mandate or encourage deployment. Major online service providers have integrated support into their authentication flows to defend high-value accounts.

Key Considerations

Implementation requires device capability (secure enclave or trusted platform module) and user adoption of appropriate hardware or platform authenticators. Recovery workflows and backup authentication methods remain necessary for account access when devices are lost or unavailable.

Cross-References(1)

Cybersecurity

Phishing

Related in Identity & Access

Multi-Factor Authentication

An authentication method requiring two or more verification factors to gain access to a resource.

Biometric Authentication

Using unique biological characteristics like fingerprints, facial features, or iris patterns to verify identity.

Privileged Access Management

Security solutions that control and monitor access for users with elevated permissions to critical systems.

Identity Threat Detection and Response

Security solutions focused on detecting and responding to identity-based attacks such as credential theft, privilege escalation, and compromised service accounts.

Deception Technology

Security solutions that deploy decoy assets such as fake servers, credentials, and data to detect, misdirect, and analyse attackers who have breached perimeter defences.

Secrets Management

The secure storage, distribution, rotation, and auditing of sensitive credentials such as API keys, tokens, passwords, and certificates used by applications and services.

More in Cybersecurity

Cross-Site Scripting

Offensive Security

A web security vulnerability allowing attackers to inject malicious scripts into web pages viewed by other users.

Extended Detection and Response

Defensive Security

A unified security platform that integrates data from endpoints, networks, cloud workloads, and email to provide holistic threat detection, investigation, and automated response.

Honeypot

Defensive Security

A decoy system designed to attract attackers and study their methods while protecting real systems.

DevSecOps

Security Governance

An approach integrating security practices within the DevOps process, making security a shared responsibility.

AI Security

Offensive Security

The discipline of protecting AI systems from adversarial attacks, data poisoning, model theft, and prompt injection while ensuring the secure deployment of AI in production environments.

Security Information and Event Management

Offensive Security

Technology that aggregates and analyses security data from across an organisation to detect threats.

Penetration Testing

Offensive Security

A simulated cyberattack against a system to evaluate the security of its defences and identify exploitable vulnerabilities.

Cloud-Native Application Protection

Offensive Security

An integrated security platform that protects cloud-native applications across the full lifecycle, combining workload protection, configuration management, and runtime security.