Phishing-resistant authentication
Hardware-backed and origin-bound credentials remove the class of failure where a convincing page collects a code. This is the clearest example of design beating vigilance.
Research program
Human error without human blame
A large part of security practice asks employees to remember instructions and behave correctly under time pressure. This program studies what happens when that expectation is replaced with technical arrangements that make the safe action the default.
Which controls can be designed so that remembering is not required?
The working principle
Claim: recommendation
If a control depends on somebody remembering a training slide from six months ago, assume it eventually fails, and design accordingly. Training remains useful where human judgment is genuinely unavoidable. It should not be the primary control where technology can prevent or detect the failure.
The problem is in the design. Blaming the person who clicked fixes nothing because someone else will click next time.
Substitutes for memory
Claim: recommendation
Each moves a remembered task into the system. They will not help equally, so the effect of each still needs to be measured.
Just-in-time and least privilege
Access that exists only while it is needed shrinks the blast radius of any single compromise without asking anyone to remember to log out of an admin role.
Automatic credential and secret detection
Scanning and revocation paths that assume secrets will be committed, pasted, and logged, because they will be.
Fail-closed defaults
Systems that stop rather than continue when a check cannot be completed, with an explicit approval path for the exception.
Risk-based authentication and session revocation
Re-verification and automatic session termination triggered by observed conditions rather than by a user decision.
Allowlisting and sandboxing
Constraining what can execute and where attachments open, so a mistaken action has a bounded consequence.
Behaviour is measurable, attendance is not
Claim: inference
Training completion rates are an attendance record. The measurable alternatives are behavioural: reporting rate for suspicious messages, time from receipt to report, credential submission rate under simulation, and the share of staff for whom a successful phish would produce no usable credential at all.
The last of those is the most interesting, because it is a property of the authentication design rather than of the people.
What would prove us wrong?
Claim: unknown
The program claims that training alone provides limited resilience without technical controls.
- Evidence that a specific training approach materially and durably reduces successful attacks in organisations with comparable technical controls.
- Results where removing memory-dependent controls produced complacency that raised exposure elsewhere.
- Data showing that phishing-resistant authentication shifts attackers to paths that are more damaging rather than less, leaving total loss unchanged.
Experiments for this program
- Bounded credential rotation Could the organisation rotate every secret of one class quickly if it had to?
Patterns and anti-patterns
- Replace remembered behaviour with system behaviour (pattern)
- Treating training completion as a control (anti-pattern)
Evidence for this program
- NIST SP 800-63, digital identity guidelines Authenticator assurance levels, including the properties that make a credential resistant to phishing.
- CISA guidance on phishing-resistant multifactor authentication Shows how the credential itself can block phishing even when a message fools the user.
- CISA Secure by Design Places responsibility for safe defaults with the supplier, which is the vendor-side form of this area's design argument.
Research notes
Design out the memory dependency
For each control that depends on a person recalling guidance under pressure, look for a technical arrangement that makes the safe action the default or the only one.
Phishing resistance belongs in the credential
Origin-bound, hardware-backed authentication removes a whole class of failure regardless of how convincing the message was. This is the clearest available example of design beating vigilance.