Phishing Resistance

Cybersecurity 15 Sep 2026 7 min read

WebAuthn Credentials Bind Authentication to Web Origins

WebAuthn Credentials Bind Authentication to Web Origins A convincing sign-in page can copy logos, typography, form layout, and even the timing of an authentication flow. Passwords offer little resistance to that imitation because the secret is portable: a person can type the same password into the legitimate site or into a hostile page that looks identical. WebAuthn changes the property that matters. Its public-key credentials are scoped to a relying party, and the browser contributes origin context to each ceremony. An attacker can reproduce the appearance of a sign-in page, but cannot simply move a WebAuthn assertion from an unrelated web origin into the legitimate relying party’s authentication flow.

Cybersecurity WebAuthn

Cybersecurity 14 Sep 2026 9 min read

WebAuthn Makes the Site Part of the Authentication Proof

A phishing page can reproduce a login screen with near-perfect visual fidelity. It can copy logos, spacing, prompts, and even the sequence of an identity provider’s screens. With a password, visual imitation can be enough: the secret typed into the counterfeit page is still a valid secret at the real service. WebAuthn changes that exchange by making site identity part of the cryptographic operation. An authenticator does not merely produce a reusable answer after a person approves a prompt. It signs data associated with the relying party and with a browser-mediated ceremony. A credential registered for one relying party is not a general credential that another site can present unchanged.

Cybersecurity WebAuthn

Cybersecurity 10 Sep 2026 9 min read

Design Push MFA to Resist Approval Fatigue

A push notification can make multi-factor authentication feel effortless: enter a password, tap Approve on a registered device, and continue. The same convenience creates a problem when the approval prompt does not require the user to prove which login they are approving. If an attacker obtains a password and can repeatedly trigger MFA requests, the legitimate user may receive prompts they did not initiate. A tired, distracted, or confused user may eventually approve one. This is commonly called MFA fatigue or push fatigue.

Cybersecurity Authentication

Cybersecurity 09 Sep 2026 10 min read

Design Push MFA to Resist Prompt Fatigue

Push-based multi-factor authentication can make sign-in convenient: after a password is accepted, the user receives a prompt on a trusted device and approves the attempt. The weakness appears when the prompt itself becomes easy to approve without understanding what it represents. If an attacker obtains a password and can repeatedly trigger approval requests, the legitimate user may eventually approve one because the prompts are confusing, disruptive, or mistaken for a request they initiated. The second factor still exists, but its security value has been reduced to a repeated yes-or-no question.

Cybersecurity Authentication