Security insights from the IDEE team

Introduction

In today's digital age, securing identities is of paramount importance for any organisation. With the increasing sophistication of cyber attacks, it is essential to prevent privileged identity compromise and the abuse of privileged access. This whitepaper explores the critical aspects of unauthorised access through effective identity and access management strategies, focusing on the pivotal roles of Privileged Identity Management (PIM) and Privileged Access Management (PAM).

Identity compromise occurs when unauthorised individuals gain access to an individual's or an organisation's credentials. This can lead to severe consequences, including data theft, financial loss, and reputational damage. According to a 2023 report by IBM, the average cost of a data breach was $4.45 million, with compromised credentials being the most common initial attack vector.

1. Phishing: Fraudulent attempts to obtain sensitive information by disguising as trustworthy entities. In the Verizon 2024 data breach investigation report the human element (phishing) was involved in 68% of breaches. The end goal of phishing is to trick people to giveaway their credentials. Its easier for cybercriminals compared to brute-forcing credentials.
2. Credential Theft: Unauthorised access to passwords and other authentication details, often through breaches of third-party services. A study by Microsoft revealed that 73% of passwords are duplicates across multiple accounts, increasing the risk of credential theft. In the IBM 2024 Threat Intelligence report, 85% of attacks were caused by phishing and the use of valid account credential theft. Furthermore, credentials were cited as the "top initial access vector", accounting for 47% of cloud environment attacks in the Google 2024 Threat Horizons Report. This makes credentials theft the "cybercriminals' most common entry point" into an organisation.
3. Adversary-in-the-Middle Attacks: Interception and manipulation of communication between two parties, allowing attackers to gain access to credentials and other sensitive information. This has been leveraged by cybercriminals to defeat conventional multifactor authentication (MFA 1.0), this includes PUSH, QR code, SMS and one-time-passwords-based MFA. With Adversary-in-the-Middle Attacks (AITM), MFA is totally bypassed allowing the threat actors access to organisation sensitive systems. This was the case of the Microsoft breach where the threat actor used AITM to compromise multiple organisations relying on Microsoft Authenticator.

Identity compromise has become the cybercriminals' most reliable approach to infiltrate organisations cum account takeover.

Phishing and stolen or compromised credentials are the two most prevalent attack vectors, costing businesses an average of $4.88 million per breach in 2024. As indicated in the Verizon 2024 data breach investigation report, stolen credentials have been responsible for more than 31% of all breaches over the past 10 years. In addition, breaches involving "stolen or compromised credentials took the longest to identify and contain (292 days) of any attack vector" according to the IBM 2024 cost of data breach report. All this is because anyone (genuine user or attacker) can access anything with the correct credentials as such detective controls has failed organisations.

Privileged accounts often have access to critical systems and sensitive data, making them prime targets for attackers. A compromise of privileged account credentials gives rise to unauthorised privileged access which then leads to catastrophic consequences. A typical example is the SolarWinds attack, where compromised privileged identities led to widespread breaches. In this attack, attackers gained access to privileged accounts and used them to distribute malware, affecting thousands of organisations globally. As identified in the IBM 2024 cost of data breach, malicious privilege insider attacks resulted in the highest average cost of USD 4.99 million. Compromised privileged identities can result in significant data breaches, ransomware, exposing sensitive information and causing substantial harm to an organisation. Trust is crucial for organisations, and a breach of privileged accounts can severely damage an organisation's reputation, leading to loss of customers and business opportunities.

To limit and or prevent privilege account takeovers, organisations need a privileged identity management.

Privileged Identity Management

PIM involves managing identities with elevated access to ensure they are properly controlled and monitored. It focuses on the lifecycle of privileged identities, from creation to deactivation, ensuring that these accounts are used securely and responsibly.

• Identity Lifecycle Management: Ensuring identities are managed from creation to deactivation. This includes regular reviews and updates to ensure that access rights remain appropriate.
• Multi-Factor Authentication (MFA): Adding an extra layer of security for privileged accounts.
• Just-In-Time Access: Granting access only when needed, reducing the risk of misuse of privileged credentials. This approach minimises the attack surface by limiting the duration for which privileges are granted.
• Role-Based Access Control (RBAC): Assigning access based on roles ensures that users have the minimum necessary access to perform their jobs. This principle of least privilege helps prevent excessive access rights.
• Audit and Compliance: Regular audits to ensure compliance with policies and regulations. Auditing privileged access helps organisations detect and respond to inappropriate use of privileges.

• Improved Control Over Privileged Identities: By managing the lifecycle of privileged identities, organisations can ensure that these accounts are used appropriately and securely.
• Reduced Risk of Unauthorised Access: Just-in-time access and RBAC reduce the risk of unauthorised access by limiting the availability and scope of privileged accounts.
• Prevent breaches: MFA helps to prevent account takeovers and as a result reduces the likelihood of a breach.
• Better Compliance with Identity Governance: Regular audits and compliance checks help organisations meet regulatory requirements and ensure that privileged identities are managed responsibly.

Privileged Access Management

PAM focuses on securing and controlling access to systems using privileged accounts. It involves protecting the credentials of privileged systems and monitoring their use to prevent misuse and detect suspicious activities.

1. Credential Vaulting: Secure storage of privilege systems' credentials to protect them from theft. Credentials are stored in an encrypted vault, reducing the risk of unauthorised access.
2. Session Management: Monitoring and controlling privileged sessions to detect and respond to suspicious activities. This includes recording sessions for audit purposes.
3. Access Control: Restricting access to critical systems to authorised users only. PAM ensures that only authenticated and authorised users can access sensitive systems.
4. Audit and Reporting: Tracking and reporting access activities to ensure accountability and transparency. Detailed logs of privileged access help organisations detect and investigate potential security incidents.

• Enhanced Security for Sensitive Systems: By securing privileged credentials and monitoring their use, PAM enhances the security of critical systems.
• Prevention of Credential Misuse: PAM reduces the risk of credential misuse by storing them securely and monitoring their use.
• Monitoring of Privileged Activities: Continuous monitoring of privileged activities helps organisations detect and respond to suspicious behaviour.
• Compliance with Access Control Regulations: PAM helps organisations meet regulatory requirements by ensuring that access to sensitive systems is properly controlled and monitored.

PIM is aimed at managing identities with privileged access, it focuses on security the identity lifecycle from creation, establishment, storage, usage, revocation and termination. PAM on the other hand focuses on securing and monitoring access to privileged systems, preventing misuse of authorised privileges. In other words, PAM focuses on the actions performed on privileged system using privileged identities ensuring that privileged system is appropriately used.

By managing the lifecycle of privileged identities, PIM ensures that privileged identities are not compromised. PAM ensures that authorised privileged access is not misused as in the case with malicious privilege insiders. PAM prevents privilege insiders from abusing their privileges and outside threat actors who manages to compromise privileged credentials from causing extended damages. So PAM is all about compliance with authorised access policies while PIM deals with the identities.

PIM & PAM Together

PIM and PAM complement each other by providing a comprehensive approach to securing privileged identities and privileged access to critical systems. Integrating both ensures robust security and compliance, protecting organisations from identity compromise and unauthorised access to critical systems.

• Scenario 1: Using PIM to manage privileged identities and PAM to control access to critical systems. PIM ensures that privileged identities are properly authenticated and verified while PAM secures the access and actions performed with these identities.
• Scenario 2: Combining identity lifecycle management with session monitoring for enhanced security. PIM manages the lifecycle of privileged identities, and PAM monitors their use, ensuring that privileged activities are secure and appropriately used.

• Comprehensive Security: Integrating PIM and PAM provides a holistic approach to managing and securing privileged identities and access to critical system.
• Improved Risk Management: By combining the strengths of PIM and PAM, organisations can better manage the risks associated with privileged identities and access.
• Enhanced Compliance: Together, PIM and PAM ensure that organisations meet regulatory requirements for identity and access management.

• Organisational Needs: Assess the specific requirements for identity and access management. Consider factors such as the size of the organisation, the number of privileged accounts, and the sensitivity of the data and systems.
• Implementation Timing: Determine when to implement PIM and PAM based on security priorities. Consider the urgency of addressing identity and access management challenges and the availability of resources for implementation.
• Integration Scenarios: Evaluate potential scenarios for implementing both solutions together. Consider how PIM and PAM can be integrated to provide comprehensive security and compliance.

• Scenario 1: When the organisation needs to manage the lifecycle of privileged identities. PIM is essential for ensuring that privileged identities are created, used, and deactivated securely.
• Scenario 2: When regulatory compliance requires strict management of privileged identities. PIM helps organisations meet regulatory requirements for identity governance and lifecycle management.

• Scenario 1: When the organisation needs to secure and monitor access to critical systems. PAM is essential for protecting privileged system credentials and ensuring that access to sensitive systems is secure and appropriately used.
• Scenario 2: When the risk of credential misuse or insider threats is high. PAM helps organisations prevent the misuse of privileged credentials and detect suspicious activities.

• Scenario 1: Large organisations with complex IT environments. Implementing both PIM and PAM ensures comprehensive management and security of privileged identities and privileged access to critical systems.
• Scenario 2: Organisations handling sensitive data or critical infrastructure. Integrating PIM and PAM provides robust protection for sensitive data and systems, ensuring that privileged identities and access are managed securely.

MFA 2.0

MFA 2.0 the AuthN by IDEE's advanced authentication that leverages a multi-faceted approach to prevent identity compromise. Unlike MFA 1.0 (such as PUSH, QR code, SMS and one-time-passwords-based), MFA 2.0 is not just phishing-resistant but phish-proof and cannot be bypassed using sophisticated attack methods such as AitM. MFA 2.0 unique characteristics includes strong identity proofing, same-device MFA, identity binding, and transitive trust to ensure robust protection against unauthorised access.

MFA 2.0 uses robust mechanisms to verify user identities during the enrolment process, reducing the risk of fraudulent accounts.

MFA 2.0 occurs on the same device, preventing interception of authentication credentials and/or tokens.

MFA 2.0 binds user identities to specific trusted devices, ensuring that only trusted devices can be used for authentication.

MFA 2.0 utilise explicit transitive trust in establishing trust across a user verified and trusted devices to prevent unauthorized access.

MFA 2.0 has demonstrated effectiveness in securing enterprise networks by ensuring only authorized personnel can access critical systems. By combining multiple layers of security, MFA 2.0 significantly reduces the risk of privilege identity compromise. The use of same-device MFA and identity binding simplifies the authentication process without sacrificing security. It can be seamlessly integrated into existing systems, providing a scalable solution for organisations of all sizes. Hence, organisations can effectively mitigate the threats of account takeover.

This multi-layered approach ensures that only the owner of the privileged identity can access a privileged system on a trusted device with a trusted credential and under the owner's total control. Hence, prevents privileged account takeover.

MFA 2.0 ensures that the complete user identity life cycle is immune to phishing, provable and cannot be subverted by a privilege insider. It significantly enhance PIM and PAM by ensuring stronger identity proofing, and establishing immutable identity credentials that cannot be stolen, phished or bypassed by insider or outside threat actors. MFA 2.0 enhance the entire digital identity lifecycle to prevent compromise of privileged identities which in turn prevents unauthorised access to privileged systems. Integrating MFA 2.0, with PIM ensures that privileged identities are adequately protected with phish-proof MFA and PAM (if required) monitors and detects insider threats.

By leveraging MFA 2.0 to protect the initial point of entry, a holistic approach to securing privileged identities and access can be achieved.

Conclusion

AuthN by IDEE offers robust MFA 2.0 for preventing identity compromise and securing privileged access. The integration of PIM and PAM, strengthened by IDEE's phish-proof MFA, provides a comprehensive approach to modern cybersecurity that is resilient to sophisticated attacks.

Introduction & Foreword

Since its inception in 2015, IDEE knew there was something special about its technology. AuthN by IDEE is (as far as we are aware) the only Multifactor Authentication solution available today that can confidently assert the claim to be phish-proof, which is why we call it MFA 2.0. AuthN by IDEE protects against every single credential phishing and password-based attack (including Adversary in the Middle – AiTM attacks).

The cybersecurity industry has for years been trying to solve the problem of digital identity by fixing passwords. And to no avail. The AuthN solution and phish-proof technology is finally here, but the challenge now is for the industry to catch up and for IT professionals to understand the science and architecture behind it.

We have created this paper to demonstrate the core differences between MFA 1.0 (push, OTP, QR and based on passwords), which was never built to prevent phishing, instead, it was created to stop password-based attacks, which are no longer the #1 attack vector. The attack vector is credential phishing and AiTM attacks, which is why MFA 1.0 is no longer fit for purpose.

Section 1

MFA 2.0 is a multifactor authentication process that assures the user identity and authentication attributes cannot be intercepted, modified and/or subverted by an attacker using phishing techniques. It ensures that the complete user identity life cycle including registration, identity proofing, authenticators establishment, authentication, recovery, re-identification, and account termination are immune to phishing attacks.

MFA 2.0 unlike MFA 1.0 does not only prevent attackers from intercepting and tricking users into revealing access credentials, it also, assures that the chain of trust established at the stage of user identity proofing is transitive, cannot be broken and is provable.

Sections 2 & 3

According to NIST (National Institute of Standards and Technology) phishing refers to an attack in which the subscriber is lured (usually through an email) to interact with a counterfeit verifier or relying party and tricked into revealing information that can be used to masquerade as that subscriber to the real verifier or relying party. The major component of phishing is "deception". Attackers use deception tactics to convince the user into giving away personal sensitive information such as passwords. Unknown to the victim, the revealed information is utilized by the attacker to access the victim's account, monitor communications, carry out illegitimate transactions and can even take over the account.

This deception can happen in so many ways and via different channels. The typical phishing method is via email, an attacker sends a link to a fake site to a target's email (this is called spear phishing). This can also be done via SMS (smishing) and social media platforms. An attacker can embed a link on a genuine website to redirect unsuspecting users to a fake site or even call a user on their phone to deceive them into granting access to their account (vishing). The one common denominator is the human element. As reported in the Verizon 2022 DBIR — 82% of all breaches were caused by the human element.

There are many methods used by attackers to phish their victims. The information targeted determines the method. Here we explain some of the methods.

In credential phishing attacks, attackers disguised as trusted senders of email, SMS messages or legitimate websites trick the victim into entering sensitive information. This is done by presenting login credentials or tricking the victim to click on an attachment or URL which sends the victim to a malicious impostor site. Stolen login credentials and sensitive information are used by cybercriminals to take over the victim's accounts to impersonate the victim for financial and other fraudulent activities.

The main goal of an attacker in credential phishing is to obtain the victim's credentials.

Prompt bombing (MFA fatigue) relies on the victim to mistakenly granting the attacker access by approving just one push notification. With the victim's username such as an email address, an attacker can initiate login to the victim's account. Each login attempt sends a notification to the victim's phone. Out of annoyance or by mistake, the victim clicks to approve and the attacker is in.

The attacker can then register their own authenticator device and lock the victim out of the account. Here, the victim does not give credentials such as a password or OTP to the attacker. They still have their credentials intact, but they have granted access to the attacker.

This is similar to prompt bombing in the sense that the attacker relies on the victim to mistakenly scan a QR code displayed on a fake website. This way the victim approves access and lets the attacker in.

The victim does not give credentials such as password or OTP to the attacker. They still have the credentials intact, but they have granted access to the attacker. The attacker can then register their own authenticator device and lock the victim out of the account.

Consent phishing attacks exploit the use of OAuth 2.0 (a protocol that allows third-party apps to access a user's account without the user's interaction).

The goal of a consent phishing attack is to trick users into granting permissions (consent) to malicious attacker-owned applications. The user sign-in takes place genuinely via a trusted identity provider, after which the attacker asks the user to grant certain permissions to the malicious app. If the permission is granted, the service provider issues an access token to the malicious app. With this token, the malicious app can access the user's account programmatically with the user's knowledge. If the user has elevated privileges, the attacker can programmatically create new accounts, install ransomware, and backdoors for continual access to the user and/or organization network.

An Adversary-in-the-middle (AiTM) attack is a phishing technique whereby the adversary (attacker) deploys a proxy server between a target (user) and a website.

The proxy server intercepts the user's login credentials and session cookie. Session cookies are used to prove the state of a user session so that the user does not have to be authenticated at every new page they visit on the website.

The intercepted session cookie is injected into the adversary's browser to access the user's account without the need for authentication even when MFA is enabled. This is because the session cookies prove to the website (web server) that the user has already been authenticated and has an ongoing session on the website. As a result, no further authentication is required.

The adversary can perform illegitimate transactions or steal sensitive data, take over the compromised account by changing the authentication credentials (password and MFA), escalate its privileges in the organization's infrastructure, and install ransomware.

Section 4

Phishing, unlike any other attack, leverages the "human element". Even if the technology and processes are securely designed, the people (human error) often give in to let attackers in. The human element drives breaches.

Here are the facts about phishing:

1. The majority of all cyberattacks occur through stolen login credentials typically obtained through various forms of phishing attacks — NIST
2. All MFA processes using shared secrets are vulnerable to phishing attacks (MFA 1.0). Shared Secret authenticators include memorized secrets, look-up secrets, out-of-band authentication (SMS/PSTN) including push notifications, one-time-passwords (OTP) and others — NIST
3. 82% of all breaches were caused by the human element — Verizon 2022 DBIR
4. Financial services are one of the most targeted sectors of phishing scams. The majority of the phishing attack campaigns (80.7%) use techniques that bypass MFA (1.0) solutions using one-time password tokens or push notifications. 42% of these attacks are associated with account takeover — Enemy at the Gates: Analyzing Attacks on Financial Services by Akamai
5. 78% of Azure AD (Active Directory) identities can be phished — "require only a username and password to authenticate" — Microsoft
6. 77% of intrusions are caused by three initial access vectors: phishing, exploitation of known software vulnerabilities and brute-force credential attacks. Phishing accounts for 37% of initial access. 70% of these incidents led to ransomware and business email compromise (BEC) — Palo Alto Networks' 2022 Incident Response Report
7. 41% of business email compromise (BEC) involved Phishing — Verizon 2022 DBIR
8. Phishing is the costliest form of data breach, USD 4.91 million in breach cost — IBM

Phishing attacks are becoming more sophisticated making it much more difficult to defend. One of these sophisticated tactics is Adversary-in-The-Middle (AiTM) attack that bypasses MFA 1.0. As reported by the Microsoft 365 Defender Research Team, more than 10,000 organizations have been targeted by AiTM phishing campaigns since September 2021 using the Evilginx2 opensource phishing toolkit.

The US government in OMB M-22-09 stipulates that agencies "must use strong MFA throughout their enterprise" as follows: "For agency staff, contractors, and partners, phishing-resistant MFA is required. For public users, phishing-resistant MFA must be an option."

Section 5

Here is a list of some of the recent phishing attacks:

Sections 6 & 7

Multifactor Authentication (MFA) is an authentication mechanism that requires more than one distinct authentication factor and each factor can be on the same device or on separate devices. For an authentication to be considered multifactor, it must use more than one factor.

A factor (authenticator) is something the claimant (user) possesses and controls that is used to verify the user's identity. A factor can be something the user knows (such as memorized secrets), something the user has (such as a device), something the user is (biometric).

An authentication mechanism that requires just one of these factors is referred to as 'single factor authentication.' When at least two of these factors or more are required, it is called multifactor authentication (MFA).

Multifactor authenticator provides more than one distinct authentication factor on the same device. One example of a multifactor authenticator is a device (possession factor), which can only be used after biometric (inheritance factor) authentication.

Another example of a multifactor authenticator is a device (possession factor), which can only be used after PIN/password-based (knowledge factor) authentication. It is important to note that without the second factor (inherence or knowledge), the device cannot be used.

As you can see from the above, multifactor authentication can be achieved using a multifactor authenticator or by combining single authenticators that provide different factors.

Below are some examples of authentication methods and the corresponding factors.

One commonality is that a verifier (the service provider or an identity provider) must store something (shared secret or public cryptographic key) to be able to verify and validate a user identity at the point of access.

All MFA which relies on memorized secrets, look-up secrets, and out-of-band authentication (SMS/PSTN) including push notifications, QR codes, one-time-passwords (OTP) is phishable. This MFA has been in use for more than a decade and we call it MFA 1.0. It is phishable because it relies on the vigilance of the user to detect and prevent disclosure of authentication secrets and/or valid authenticator outputs to attackers.

To prevent (resist) phishing, an MFA needs to be able to detect and prevent disclosure of authentication secrets and outputs to a website or application masquerading as a legitimate system. Only two of the MFA methods listed above can resist phishing – FIDO2 and WebAuthN.

Phishing-resistant MFA uses asymmetric key cryptography for protection from phishing attacks. NIST SP 800-63-3 refer to them as cryptographic authenticators, this includes PIV/CAC cards, FIDO2 security keys and WebAuthN. FIDO2/WebAuthN are multifactor cryptographic authenticators that use a hardware cryptographic module to prove possession of an authentication secret through direct communication, via the endpoint, with a verifier. However, they only focus on a single part of the identity lifecycle, authentication, and thus they are phishing-resistant, but not phish-proof. In order to be phish-proof the MFA needs to address the complete user identity life cycle including registration, identity proofing, authenticators establishment, authentication, recovery, re-identification, and account termination. Thus, phishing resistant MFA is MFA 1.0.

Section 8

MFA 1.0 focuses solely on the authentication process. Thus we coined the term, MFA 2.0 because it ensures that the complete user identity life cycle including registration, identity proofing, authenticators establishment, authentication, recovery, re-identification, and account termination is immune to phishing attacks. According to NIST "phishing resistant authenticators only address one focus of phishing attacks – the compromise and re-use of authenticators such as passwords and one-time passcodes. They do not mitigate phishing attempts that may have alternative goals such as installing malware or compromising personal information to be used elsewhere."

The inherent problem with MFA 1.0, even when it is phishing resistant, is that identity proofing is decoupled from authenticator provisioning. The cryptographic device authenticators are added as an afterthought. This is exasperated by the so-called best practice of having a "break-glass access and mandatory fall-back authentication method", which is never the same as the primary authentication method and relies on phishable factors such as passwords and OTPs.

Naturally, attackers go for the weakest link and in this case, would compromise the break-glass and/or the fall-back authentication method to gain access and easily add additional phishing-resistant MFAs. Furthermore, phishing-resistant MFAs do not prevent the use of synthetic identity, identity proofing compromise, account takeover, and insider threats. And finally, with initial access brokers (IAB) on the rise, MFA 1.0 cannot prevent malicious insiders from selling access to criminal gangs for financial returns. This is the modus operandi of groups like the Lapsus$ ransomware group, who recruit insiders.

Section 9

The only sure fire way to prevent phishing is to use MFA 2.0. Unlike MFA 1.0, which prevents attackers from intercepting and tricking users into revealing access credentials, MFA 2.0 in addition, assures that the chain of trust established at the stage of user identity proofing is transitive, cannot be broken and is provable from the start to the end of a user identity life cycle.

MFA 2.0 assures that the registration and identity proofing process cannot be compromised, that the established trust in the user identity at identity proofing is explicitly transited to the authenticator's establishment, and that the authenticators are based on a secure cryptographic authenticator device which is tamper-proof and tamper-resistant.

It does not just stop there, MFA 2.0 ensures an end-to-end direct trust between the service provider (relying party) and the authenticator device. This trust cannot and must not be altered by intermediaries (such as identity providers). It ensures that the complete user identity life cycle is immune to phishing, provable and cannot be subverted by a privileged insider.

With MFA 2.0, detection, and prevention of disclosure of authentication secrets and outputs to a website or application masquerading as a legitimate system is just not possible. To summarize, a MFA 2.0 solution offers comprehensive prevention of all credential phishing and adversary-in-the-middle attacks as well as MFA bypass attacks, whereas MFA 1.0 solutions only provide phishing resistance but not prevention.

Conclusion

1. Any MFA is better than no MFA.
2. Any MFA that relies on the vigilance of the user to detect and prevent disclosure of authentication secrets and valid authenticator outputs to attackers (MFA 1.0) is phishable.
3. Phishing-resistant, an MFA 1.0 must: prevent capturing of authentication data from the user; detect and prevent the use of authenticators at illegitimate websites; detect and prevent an adversary-in-the-middle from intercepting user authentication session cookies; eliminate the need for manual entry of authentication factors; prevent the replay of valid authentication outputs.
4. Phishing-resistant MFA (MFA 1.0) only addresses one type of phishing attack – the compromise and re-use of authenticators such as passwords and one-time passcodes. They do not prevent the use of synthetic identity, identity proofing compromise, account takeover, insider threats and other types of attacks.
5. MFA 1.0 solutions are not the same as MFA 2.0 solutions.
6. Both phishing-resistant MFA 1.0 and MFA 2.0 use asymmetric key crypto where the private key is used to digitally sign, and the public key is used to verify the signature. It provides authenticity and integrity protection as well as non-repudiation.
7. MFA 2.0 does not only detect and prevent interception and usage of authenticators on fake websites. It assures that the chain of trust established at the stage of user identity proofing is transitive, unbreakable and provable from the start to the end of a user identity life cycle.
8. MFA 2.0 ensures an end-to-end direct trust between the service provider (relying party) and the authenticator device. This trust cannot and must not be altered by intermediaries (such as identity providers). It ensures that the complete user identity life cycle is immune to phishing, provable and cannot be subverted by a privileged insider.
9. The only sure fire way to prevent phishing is to use MFA 2.0.