Passkey vs Password MFA: NIST Rules and Phishing Resistance

TribeAI · 1/7 Passkey vs password MFA explained through NIST rules on passwords, syncable authenticators, SMS and email, and the open question of phishing resistance.

The context

TribeAI · 2/7 The rule: syncable authenticators are excluded at AAL3.

Key point

TribeAI · 3/7 The stated reason: they require the private key to be exportable.

Key point

TribeAI · 4/7 Whether a specific product sold or labeled as a passkey is a syncable authenticator.

Key point

TribeAI · 5/7 How the guideline treats syncable authenticators at levels other than AAL3.

Bottom line

TribeAI · 6/7 Whether any passkey meets a definition of phishing resistance.

Sources

TribeAI · 7/7 Educational content, not investment advice. Full article and sources below. Passkey vs Password MFA: NIST Rules and Phishing Resistance Passwords, MFA and passkeys: what NIST and CISA actually say pages.nist.gov cartilha.cert.br Read the article