T3 · Zero trust · Simulated in your browser
Phishing-resistant MFA
Relay a login through a fake page, method by method, and see which ones the real site can tell from the genuine thing.
Most MFA stops password guessing but not a fake page that relays your code in real time. Phishing-resistant MFA binds the login to the real site, so there is nothing to replay.
- The steps appear here, one by one.
Pick a method and press the button to watch what crosses between you, the look-alike site and the real one.
What each method stops
Strongest to weakest, after CISA’s fact sheet. Click any cell for its source.
| Method | Phishing (real-time relay) | Push bombing | SS7 interception | SIM swap | Phishing-resistant (NIST) | AAL3 allowed |
|---|---|---|---|---|---|---|
| Hardware security key | ||||||
| PKI smart card (PIV-style) | ||||||
| Synced passkey | ||||||
| Password + push with number matching | ||||||
| Password + authenticator-app code | ||||||
| Password + push approval | ||||||
| Password + SMS code | ||||||
| Password only |
Pick a cell to see why it says what it says, and where that comes from.
n/a means the threat has no step to attack in that method. Where CISA’s table is silent (the phishing cells of a bare password and of plain push), the cell cites NIST or OMB instead and says so; the other cells of a bare password cite the table for the lack of a push or phone step.
Most multi-factor authentication stops someone guessing your password. Much of it does not stop a fake login page that passes what you type to the real site while you wait. CISA’s fact sheet ranks the options from strongest to weakest and calls phishing-resistant MFA “the gold standard”. Pick a method above and press the button to watch the relay.
A password, an authenticator-app code and an SMS code are all things you type, so a fake page can ask for them and pass them on. Plain push approval has a different weakness: an attacker with the password can trigger prompt after prompt until someone taps approve, which is push bombing.
Number matching defeats the bombing, because the person has to type the number shown on the login screen. It does not defeat a relay. The person reads the number off the attacker’s copy of the page and types it into their phone, and CISA’s fact sheet still lists it as vulnerable to phishing.
A passkey or security key works differently, and that is why it is on the other side of the line. The credential is created for one site, identified by its relying-party ID, and the browser will not use it for another. A look-alike page cannot ask for the real site’s credential, and the client data records the origin of the page that asked, so a relayed answer would carry the wrong one. The step panel shows those fields.
NIST agrees on where the line falls: phishing resistance needs cryptographic authentication that is bound to the verifier, a manually entered code never qualifies, and the public phone network is the one authenticator type it restricts. It also separates passkeys that sync between devices from device-bound ones: the first can meet AAL2, but only a device-bound key can reach AAL3.
The table below shows each method against the four threats CISA lists. Click any cell for its source and the reason. Where CISA’s table is silent, the cell cites NIST or the federal memo instead and says so. The memo’s rule, that agency staff use phishing-resistant MFA and not SMS, voice, codes or push, is a federal requirement and not advice to a business.
Exercise
Add passkey sign-in to a toy app, then try to fool it from another hostname.
- Add passkey sign-in to a small app with any WebAuthn library, and give your machine two hostnames for it (for example two names for 127.0.0.1 in your hosts file). Serve the app on the first and set the RP ID to that name.
- Register a passkey on the first hostname, then load the same app from the second hostname and try to sign in. The browser finds no credential for it, and a page on the second hostname that asks for the first one’s RP ID is refused.
- Do not use two ports on one hostname: the RP ID is a domain, not an origin, so a passkey registered on one localhost port is offered on another. Read the specification’s RP ID check to see why.
Sources
CISA, Implementing Phishing-Resistant MFA Implementing Phishing-Resistant MFA (fact sheet). Oct 2022; read 2026-10-22; read again 2026-10-23.
- Table 1 (strongest to weakest) and the summary of the threats: phishing, push bombing, SS7 interception and SIM swap
- Table 1: app OTP, SMS or voice and push without number matching
- Table 1: push with number matching, vulnerable to phishing
NIST SP 800-63B-4 Digital Identity Guidelines: Authentication and Authenticator Management (D. Temoshok et al.). Jul 2025; read 2026-10-22.
- Section 3.2.5: methods where a secret is entered by hand are not phishing-resistant
- Section 3.2.5: phishing resistance
- Section 3.2.9: the public switched telephone network as a restricted authenticator
- Section 2.3.2 and Appendix B: syncable authenticators and AAL3
WebAuthn Level 3 Web Authentication: An API for accessing Public Key Credentials, Level 3 (W3C). Sections 1, 5.1.3, 5.1.4.1, 5.8.1 and 7.1 read; 7.2 only to step 6. W3C Recommendation, 25 Aug 2026; read 2026-10-23.
- Section 1: credentials are scoped to the relying party
- Section 5.1.4.1, step 7: the browser checks the requested RP ID against the calling origin
- Section 5.8.1: the client data holds the type, the challenge and the origin
- Section 7.1, steps 7 to 9 and 14: the relying party checks the type, challenge, origin and RP ID hash (the registration ceremony; the authentication ceremony, 7.2, was read only to step 6)
- Section 5.1.4.1, step 7: the RP ID check against the calling origin’s domain
FIDO Alliance, Passkeys FIDO Passkeys: Passwordless Authentication. The page’s commissioned-survey figure is not used. no date on the page; read 2026-10-22.
- Synced versus device-bound passkeys
OMB M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (OMB). A federal requirement, not advice to businesses. 26 Jan 2022; read 2026-10-22.
- Pages 6 and 7: phishing-resistant MFA for staff and the move away from SMS, voice, OTP and push (federal)
Everything here is paraphrased from the sources, not quoted at length, and every claim is attributed to one. The NSA’s own zero trust sheets could not be opened, so they are not cited; the CISA alert about them is. Anything illustrative is labelled as such. Where a source is silent or could not be read, the page leaves the fact out.