Most MFA does not stop phishing. SMS, TOTP, and push approvals are all secrets the user can be tricked into handing over, and in 2026 the tools that trick them are a commercial service. Only one thing actually stops it: an authenticator that is cryptographically bound to the real site's origin, so it stays silent on the fake one. That is FIDO2, and it is the whole point.
tag: #mfa
1 posts