thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

Phishing-Resistant MFA

MFA methods that cannot be relayed or tricked into authenticating to a fake site, such as FIDO2 or PKI.

Definition

Phishing-resistant MFA cryptographically binds authentication to the legitimate origin or uses certificates on hardware, so credentials entered on a lookalike site are useless. CISA and OMB M-22-09 require it for federal agencies. FIDO2 security keys, passkeys, PIV/CAC smart cards, and Windows Hello for Business qualify; OTP, SMS, and push do not.

Example

An attacker's adversary-in-the-middle proxy cannot capture a passkey sign-in because the browser binds it to the real domain.

Exam tip

OTP codes and push approvals can be phished; FIDO2/WebAuthn and PIV cannot.

Related terms