Overview
Direct Answer
Phishing-resistant authentication uses cryptographic mechanisms that bind credentials to a specific legitimate service, preventing attackers from harvesting and reusing credentials on fraudulent sites. Standards such as FIDO2 and WebAuthn exemplify this approach by leveraging public-key cryptography rather than shared secrets.
How It Works
The authentication flow uses asymmetric cryptography where a private key remains on the user's device and never transmitted. During registration, the service receives only a public key. At login, the device cryptographically signs a challenge that includes the service's origin (domain); an attacker's phishing site cannot forge a valid signature because it cannot access the private key or produce a signature matching a different origin.
Why It Matters
Organisations face escalating costs from credential compromise and account takeover. Unlike passwords and SMS one-time passcodes, origin-bound credentials eliminate the attack surface for phishing exploitation, reducing both breach risk and incident response overhead whilst improving user experience by eliminating memorisation burdens.
Common Applications
Enterprise single sign-on systems, financial services platforms, cloud infrastructure access, and government identity verification programmes increasingly mandate or encourage deployment. Major online service providers have integrated support into their authentication flows to defend high-value accounts.
Key Considerations
Implementation requires device capability (secure enclave or trusted platform module) and user adoption of appropriate hardware or platform authenticators. Recovery workflows and backup authentication methods remain necessary for account access when devices are lost or unavailable.
Cross-References(1)
More in Cybersecurity
Security Operations Centre
Defensive SecurityA centralised facility where security professionals monitor, detect, analyse, and respond to cybersecurity incidents.
Ransomware
Offensive SecurityMalicious software that encrypts a victim's files and demands payment for the decryption key.
Security Audit
Security GovernanceA systematic evaluation of an organisation's information system security by measuring compliance with established criteria.
Honeypot
Defensive SecurityA decoy system designed to attract attackers and study their methods while protecting real systems.
Next-Generation Firewall
Defensive SecurityAn advanced firewall that goes beyond traditional packet filtering to include application awareness and intrusion prevention.
Breach and Attack Simulation
Offensive SecurityAutomated security testing that continuously simulates real-world attack scenarios against production environments to validate defensive controls and identify security gaps.
Attack Vector
Offensive SecurityThe specific path, method, or scenario used by an attacker to gain unauthorised access to a system.
Zero-Day Vulnerability
Offensive SecurityA software security flaw unknown to the vendor that can be exploited before a patch is available.