Chapter 8 · 2014–2022

The unphishable key

The trick that finally beat phishing: a key that signs a challenge bound to the real site, so a fake page gets a useless answer. Then it went into the login screen and the password field vanished.

Chapter 7 ended on the flaw every factor shared: it flowed through a human, and a human can be fooled into handing it to the wrong site. The fix, shipped by Google and Yubico in 2014 as U2F, is one of those ideas that seems obvious only afterward — and it beats phishing not by training the human better, but by making the human’s mistake harmless.

Here’s the move. Instead of the user typing a secret, a small hardware key holds a private cryptographic key and signs a challenge from the site. The signature includes the real site’s web address, checked by the browser, and the private key never leaves the device. Now run the attack from chapter 7: you land on a perfect replica of your bank at a look-alike address. The fake page asks your key to sign in. The key signs — but it signs for the fake address, because that’s where the browser says it is, and the bank rejects a signature meant for someone else’s origin. The phishing page gets a cryptographically valid answer to the wrong question, which is worth nothing. Try it below: type your credentials into the fake site and watch a password get stolen, then do the same with a key and watch the theft produce garbage.

The results were not subtle. After Google issued security keys to its tens of thousands of employees, it reported successful phishing takeovers among key users at zero — not reduced, not mitigated, zero. A category of attack that had worked reliably since the first fake login page simply stopped working against people carrying a key. The factor you have had finally become a factor you can’t be talked out of.

Two problems remained, and solving them is what turned a security-nerd gadget into something your phone nags you to set up. First, U2F needed a physical dongle most people would never buy. So the idea was standardized into the browser and operating system itself: WebAuthn, a W3C standard in 2019, put the same challenge-signing cryptography into billions of phones and laptops, using the fingerprint sensor or face camera as the unlock. No dongle — the authenticator was already in your pocket. Second, it was still a second factor bolted onto a password. Why keep the weak thing at all?

That question is passkeys, and in 2022 Apple, Google, and Microsoft — three companies that agree on almost nothing — shipped them together. A passkey is a WebAuthn credential that syncs across your devices and replaces the password outright: you log in with the same face-or-fingerprint gesture that unlocks your phone, and there is no password field anywhere in the flow. Phishing-resistant by construction, nothing to type, nothing to leak, nothing to reuse. For the first time in sixty-one years, the password left the login screen.

But read this site’s title before you celebrate the funeral, because the thesis has the last word here too. The password left the screen. It did not leave. Watch where it went. Your passkey is protected by your device PIN — a short secret you type, guarding the thing that guards everything. When you get a new phone, you restore your passkeys through an account recovery flow — which falls back to a password, or an emailed code, or a security question, because it has to work when the device is gone. The unphishable front door now hides a very phishable back one. The industry moved the password from the place everyone looks — the login form — to the places almost nobody audits: the PIN pad and the recovery path. One layer down, exactly on schedule.

That’s the “proving the person” branch at its summit: genuinely, enormously better, and still built on a secret it has relocated rather than removed. The other branch has been climbing in parallel — not proving who you are but managing what you reach once proven — and it’s about to conclude something even more radical: that the walls themselves were the mistake.