Signal SentrySearchUpdated Nov 2, 05:30 UTCAM Drop
Security lens · Identity and access

Phishing-resistant sign-in

A stolen password, or a one-time code typed into a fake sign-in page, is not enough to take over the account.

Where to start

Our reading of the guidance below, for a small team. A starting point, not a complete program.

  1. Turn on security keys or passkeys for email, code hosting, cloud and package registry accounts, admins first.
  2. Once everyone has a key or passkey, stop accepting texted or app-generated codes on admin accounts.
  3. Register a backup key for each person so a lost one does not push them back to codes.

The guidance

  1. NIST · NIST Special Publication 800-63B

    Authenticators that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant because the manual entry does not bind the authenticator output to the specific session being authenticated.

  2. OWASP · Multifactor Authentication Cheat Sheet

    Prefer phishing-resistant authenticators (FIDO2/WebAuthn), which bind authentication to the legitimate origin and resist credential theft, MFA fatigue, and reverse-proxy phishing.

Short quotes from the official guidance, linked. Read the source before you act on it.

Incidents from the Drops

Security

Canada's Cyber Centre warns of help-desk vishing that relays MFA to steal sessions

The Cyber Centre says callers posing as IT support push staff, lately in legal and finance, to branded fake sign-in pages that pass passwords and MFA codes on in real time, then pull Microsoft 365 data and send extortion demands.

Why it matters: Codes typed into a relayed page do not stop this. The Cyber Centre advises phishing-resistant MFA and independent checks on MFA resets; start with staff who hold production access.

Confirmed Way in: phone calls posing as the IT help desk, then fake sign-in pages relaying passwords and MFA codes

Controls that would have helped:

Canadian Centre for Cyber Security · Oct 28
From Drop #061 · Mon, Nov 2, 2026 · Morning