Phishing-resistant MFA
Authentication methods that cannot be relayed by a fake login page, because the credential is bound to the real site.
FIDO2 security keys and passkeys verify the domain they are talking to as part of the protocol. Present them to a lookalike site and they simply refuse, because the origin does not match. Certificate-based authentication resists the same attack by a different route, since the signature is bound to the TLS session and a proxy cannot relay it onward to the real site.
This is the meaningful difference from app codes and push notifications, which a real-time proxy can capture and replay. For administrators and anyone handling money, this class of method is worth the migration effort.
Where this comes up
Phishing-resistant MFA sits inside our identity and access work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.