Phishing resistant MFA that a fake login page cannot get around
Phishing resistant MFA is multi-factor authentication that still protects the user when they land on a convincing fake sign-in page. Codes sent by text message and codes from an authenticator app do not meet that bar, because a user can type them into the wrong site. Passkeys and security keys do, and the Skycloak Platform is built to give your users those factors without new code in your application.
Why codes are not enough
A one-time code proves that the user holds a phone, but not which site they are typing it into. Attackers run proxy pages that sit between the user and the real site: the user enters their password and code on the fake page, the proxy passes them to the real site at once and keeps the session it gets back. The second factor was used, and the account is lost anyway.
Push approvals have a related weakness. An attacker who already has the password sends prompts until a tired user taps approve, which is why security teams now ask for factors that need no judgment from the user at all.
What makes a factor phishing resistant
Passkeys and FIDO2 security keys use the WebAuthn standard. The browser tells the authenticator which site is asking, and the authenticator only signs for the site the credential was created for. On a fake address there is simply no credential to use, so the attack fails without the user having to notice anything.
This is the property that guidance such as the US government's zero trust strategy and many enterprise security questionnaires now name directly when they ask about multi-factor authentication.
How the Platform provides it
Passkeys and multi-factor authentication are on the Platform's plan, with passkeys built on go-webauthn. Your tenant's sign-in page handles enrolment, sign-in and recovery, and your application receives the same OpenID Connect tokens whichever factor was used.
For business customers who already enforce phishing resistant factors in their own directory, enterprise SSO over SAML is on the plan as well, so their policy applies when their employees sign in to your product. We describe a feature as available only once it has shipped, so a demo is where you see what you can use today.
Frequently asked questions
Are authenticator app codes phishing resistant?
No. They are much better than passwords alone, but a user can type the code into a fake page, and an attacker can relay it to the real site in seconds.
Is a passkey a second factor or a replacement for the password?
It can be either. A passkey combines something the user has, the device, with something they are or know, the unlock, so on its own it already counts as multi-factor.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.