Phishing-resistant multi-factor authentication (MFA)

While MFA can be a strong first-line of defense, not all forms of multi-factor authentication (MFA) are created equal. Legacy authentication such as usernames and passwords can be easily hacked, and mobile-based authentication such as SMS, OTP codes, and push notifications are highly susceptible to modern phishing attacks, malware, SIM swaps, and man-in-the-middle (MiTM) attacks.

Additionally, there are almost always edge cases of employees that can’t, don’t, or won’t use mobile authentication. Not only can there be low cell coverage in certain geographic areas, employees also may not want to use personal devices for work, or don’t want to allow admin access to their devices. There may also be union restrictions or compliance requirements, and some employees may not be able to even use a smartphone. If the fall back option is usernames and passwords, this makes the organization even more vulnerable to phishing and account takeovers.

Hardware-backed public key cryptography

YubiKeys use secure public key cryptographic technology to generate unique public and private key pairs for each service. The private keys are stored securely on  the YubiKey, making them hardware-bound and non-copyable, unlike legacy MFA.

Proof of user presence

Logging into a service with a YubiKey requires the user to touch or tap the key to authenticate. The touch sensor on the YubiKey verifies that the user is a real human and that the authentication is done with real intent. This prevents remote attacks that can easily bypass software-based MFA.

Origin-bound keys

Once you register your YubiKey to a service, it is bound to that specific URL, and the registered credential cannot be used to log in to a fake website. This means that even if a user is tricked into clicking a link that takes them to a fake website, the YubiKey is never fooled, so the phishing attempt is thwarted!

No shared secrets across apps

YubiKeys authenticate through the FIDO open standard, enabling access to thousands of applications and services, providing high security and privacy at scale, across both work and personal lives. A single key can be used to authenticate across any number of applications and services with no shared secrets, ensuring complete protection.

Dive into the 2024 Gartner® Hype Cycle™ for Digital Identity

Not all authentication methods are created equal—including passkeys. Get the report to learn about modern, phishing-resistant MFA using device-bound passkeys that stop account takeovers and deliver impactful business impact for zero trust.