NEW YORK — What happened: Recent enterprise security audits highlight a massive surge in the adoption of FIDO2-compliant physical security keys and passkeys, driven by a sharp rise in sophisticated phishing attacks that bypass standard multi-factor authentication.
Why it matters: Traditional MFA methods like SMS codes or basic authenticator app numbers are easily intercepted by modern proxy-based phishing kits. Phishing-resistant authentication binds credentials cryptographically to the specific domain.
Deep dive: Adversary-in-the-Middle (AiTM) toolkits can capture session cookies in real time. Hardware security keys defeat this by requiring physical touch and verifying the cryptographic origin of the login page, making credential relay attacks impossible.
Report check (claims vs what is verified vs still rumor): Security vendors claim zero successful breaches among clients using hardware keys exclusively. While technically true for credential theft, experts remind organizations that endpoint malware can still hijack active authenticated sessions.
Open questions: What are the best recovery procedures when employees lose their physical security keys?