Multi-factor authentication was sold as the cure for phishing, and for a while it was. Then real-time proxy phishing, push-bombing, and SIM swaps caught up. The 2022 breaches at Twilio and Uber — and the Cloudflare attack that failed — were the field test. A threat-model walk through why only origin-bound MFA survives, and how to deploy it.
Phishing
-
Phishing-Resistant MFA: Why Everything Short of FIDO2 Is Living on Borrowed Time