SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-fido-webauthn

CISA says the only widely available phishing-resistant sign-in method is what?

FIDO/WebAuthn authentication.

Start playing free

  1. SMS codes
  2. Email codes
  3. FIDO/WebAuthn ✔

Why: FIDO keys and passkeys prove who you are only to the real website. A fake site cannot reuse them. Codes sent by text or email can be typed into a fake page.

Huh, didn't know that: CISA says WebAuthn support is included in major browsers, operating systems, and smart phones.

The dad joke
I got phished. Twice. Same email. I just like clicking things.
Like this card?
Play the game

References

Answer: FIDO/WebAuthn. FIDO keys and passkeys prove who you are only to the real website. A fake site cannot reuse them. Codes sent by text or email can be typed into a fake page.

  1. CISA: Implementing Phishing-Resistant MFA fact sheet www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
    The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich kind of MFA does CISA call the gold standard?Security & PrivacyWhat is push bombing, also called MFA fatigue?Security & PrivacyWhich sign-in method does CISA list as vulnerable to phishing?

That's stuff everyone should know.