Beyond Passwords

A password is a shared secret

You know it. The website keeps a copy (scrambled, if you are lucky). Anyone who learns it, becomes you.

• It can be tricked out of you: a fake page, an urgent mail, a phone call.
• It can be stolen from the website: you cannot control how well every site guards it.
• It can be guessed by machines that never get tired.
• Nobody can memorise a hundred strong secrets, so passwords get reused. One leak then opens many doors.

How accounts actually get taken

Almost none of this is aimed at you personally. It is automation, running at internet scale, looking for the easiest doors.

MFA: one proof is not enough

Multi-factor authentication means proving who you are with two different kinds of proof.

A password plus a security question is not MFA: that is the same kind twice. The point of MFA: a stolen password alone no longer opens the account.

Not every second factor is equal

Every rung beats no MFA at all. The jump that matters is the top one.

SIM swap: your number can be taken over

A phone number is not really something you have. It is something the phone company lends you. And they can be talked into lending it to someone else.

1. Collect. The attacker gathers your details from leaks and social media.
2. Impersonate. They call your carrier: “Lost my phone, please move my number to this new SIM.” Sometimes it is a bribed insider instead.
3. Take over. Your phone drops to “no service”. Theirs now receives your calls and texts.
4. Cash in. “Reset password via SMS”. Every code now flows to the attacker.

Also: cancelled numbers get recycled and handed to strangers, along with any account still tied to them.

The network behind SMS was never built for secrets

• Text messages ride on SS7, the routing system carriers use between each other, designed in the 1970s. Its security model: carriers trust carriers.
• That access leaks. It has repeatedly been rented, resold and abused. With it, texts can be silently rerouted from anywhere on earth.
• It has happened: in 2017, criminals rerouted SMS banking codes through SS7 and emptied the accounts of German bank customers.
• Since 2017, NIST (the US standards body) classifies SMS codes as a restricted sign-in method: to be used only when nothing better is available (SP 800-63B).

SMS still beats having no MFA at all. But it is the floor, not the goal.

The attack that beats most MFA: the live relay

Everything is forwarded live, in both directions.

• The fake page is a proxy. Your password: forwarded. Your fresh SMS or app code: forwarded within seconds. The login succeeds. But the attacker keeps the logged-in session, not you.
• This defeats SMS codes, app codes and simple push approvals. Off-the-shelf kits (Evilginx and friends) have made it a routine, rentable attack.
• Cousin attack, push bombing: hammer someone with “Approve sign-in?” prompts until a tired human taps approve. That is how attackers got into Uber in 2022.

The fix: stop sending secrets at all

Security keys and passkeys use a key pair instead of a shared secret.

1. The site sends a fresh, one-time challenge.
2. Your device signs it with the private key.
3. The site checks the signature with the public key. Done.

Nothing reusable crosses the wire. Nothing secret sits on the server. A breached site spills keys that can only ever check, never open.

Why phishing simply stops working

• When you sign in, the browser itself stamps the website's true domain into the request, and that stamp is part of what gets signed.
• A passkey created for yourbank.be does not exist for yourbank-login.be. The fake site cannot borrow it. It cannot even ask for it.

Phishing works because humans check domains with tired eyes.
Passkeys check them with cryptography, which never skims, never rushes, and is not impressed by a convincing logo.

Security keys: the dedicated tool

• A small USB or NFC device that keeps private keys in tamper-resistant hardware. YubiKey, Google Titan, Nitrokey…
• A touch proves a human is physically present. A PIN or a fingerprint on the key can be required on top.
• The keys cannot be copied out: not by malware on the computer, not by the vendor, not by you.
• Built on the open FIDO2 / WebAuthn standard: supported by every modern browser and operating system.
• Ideal for mailboxes, admin accounts, finance, and anyone likely to be targeted. Buy two: register both, keep one as the backup.

Passkeys: the same protection, no extra hardware

• The same FIDO2 cryptography, built into the phone or laptop you already own.
• Unlocked with your fingerprint, face or device PIN. Biometrics never leave your device: the website receives a signature, never your face.
• There is no password at all: nothing to invent, remember, reuse or phish.
• Synced passkeys are backed up through iCloud Keychain, Google Password Manager, Bitwarden, 1Password… Lose the phone, keep the keys. The sync account becomes the crown jewel, so protect it with a security key.
• Device-bound passkeys live only on a security key. Nothing in any cloud.
• On another computer: scan a QR code with your phone. A Bluetooth proximity check proves your phone is really next to that screen, so the QR cannot be relayed to the other side of the world.

Side by side

Rows starting with + keep the password and add a second factor on top. Only the last row removes the password entirely.

* not the key's doing: a security key shares no secret itself. The ~ points at the password still sitting next to it on the server. Use the same key without a password (it then holds a passkey) and the bottom row applies.   ** number matching stops push bombing, but not the live relay.

What to do, starting today

1. Turn on MFA everywhere. Any MFA beats none. Attackers pick unlocked doors first.
2. Prefer passkeys wherever they are offered: Google, Microsoft, Apple, GitHub, PayPal…
3. No passkey option? Use an authenticator app, not SMS.
4. Keep SMS as a last resort only, and where possible remove your phone number as a recovery method. Recovery is the back door.
5. Password manager plus a unique password for every site that still needs one.
6. Protect the mailbox above everything. Email resets all other accounts. It deserves a passkey or a security key.
7. Admins and likely targets: two hardware security keys and phishing-resistant MFA as policy, not as a suggestion.

Honest limit: passkeys stop phishing, they do not stop malware already on your machine. Updates still matter.

The whole story in three lines

• Passwords are shared secrets: they get phished, reused and breached.
• MFA is essential, but codes can be relayed live, and SMS can be stolen at the carrier.
• Passkeys and security keys share no secret and check the domain cryptographically. Phishing stops working.

Questions?

Sources: Microsoft identity security research (2019) · Google & NYU account-hygiene study (2019) · NIST SP 800-63B · documented SS7 banking attacks, Germany (2017) · Uber breach post-mortems (2022) · FIDO Alliance / W3C WebAuthn specifications.