Phishing-Resistant Auth
Why every code you can type can be relayed, how origin binding fixes it, the WebAuthn ceremony in detail, and a step-up ladder that mixes OTP and passkeys sensibly.
Requires: OTP Cryptography Internals
Chapters
- 1
Why phished OTPs break authentication
Real-time relay phishing turns any typed code into the attacker’s code. Understand the mechanics so you stop expecting shorter windows to help.
6 min read
- 2
Origin binding: the core idea behind passkeys
Replace a typed secret with a signature over the origin the browser actually sees. Relay becomes useless by construction.
6 min read
- 3
WebAuthn ceremony: challenge, authenticator, attestation
Registration and authentication in full: what the server sends, what the authenticator signs, which flags matter and when attestation is worth it.
6 min read
- 4
Passkeys in practice: account model, recovery pitfalls
Model credentials as a many-to-one relationship, design for lost devices from day one, and avoid recovery flows that quietly reintroduce phishing.
5 min read
- 5
Mixing OTP and passkeys: a pragmatic step-up ladder
Assign each action an assurance level, map factors to levels honestly, and step users up only when the action needs it.
6 min read