This writer provides a primer arguing for authentication standards mandates like seatbelts/airbags against increasingly sophisticated phishing, credential theft.
It is hard to believe this now, but there was a time when automobiles did not come with now-ubiquitous three-point seatbelts. The change happened in 1959 when the technology was made freely available for other manufacturers to use. This commercial decision, alongside airbags, would go on to save millions of lives.
Similarly, the digital world should now offer a seatbelt-like buffer: Identity theft, data breaches, and infrastructure compromises continue to pose persistent risks. Phishing attacks, increasingly aided by AI, are growing more sophisticated. Beyond authentication methods, there is a need for security standards that are widely accessible, simple to use, and embedded in the infrastructure people depend on.
Like seatbelts, digital security only works if it works broadly. Yet despite this awareness, many organizations still rely on authentication methods designed for a different era.
Two major threat landscape vectors
Credential-based attacks are accelerating, and account takeover attacks also increased globally last year, according to some official estimates.
Next, phishing attacks have become faster, more targeted, and easier to scale. Attackers can automate campaigns and tailor messages using publicly available information, generating convincing phishing emails with minimal effort.
Alongside these changes, some underlying issues persist. Many organizations continue to depend on authentication methods that remain susceptible to phishing and exploitation. While SMS- or app-based multi-factor authentication (MFA) adds a layer of protection, these approaches still rely on shared secrets.
Shared secrets can be compromised if users are tricked into revealing them, making them vulnerable in phishing scenarios.
Traditional training also struggles to keep pace with evolving attacks. As phishing becomes faster and more automated, defenders must consistently prevent attacks, while attackers only need a single success.
Moving beyond shared secrets
With attackers generating large volumes of phishing emails, harvesting credentials in real time, and automating login attempts, passwords alone are increasingly insufficient.
One alternative removes shared secrets using platform or device-based cryptography aligned with standards aligned with standards such as FIDO2, WebAuthn and CTAP2. These standards use public-key cryptography where a private key stays securely stored on the user’s device (via CTAP2), while the corresponding public key is registered with the service (via WebAuthn).
During login, the service sends a cryptographic challenge that only the registered device can sign and return. Because the private key never leaves the device, it cannot be phished or remotely extracted.
Large-scale deployments of phishing-resistant authentication have shown strong results in reducing account compromise. However, beyond security, such approaches can also improve usability. Some implementations work offline and in smart-device-restricted environments. Broader adoption requires industry interoperability around open standards and interoperability across platforms and devices.
The seatbelt became ubiquitous because it was simple, effective, and widely adopted. Digital security now requires a similar approach: not fragmented solutions — but broadly accessible protections that can be implemented at scale. Security protects what matters most when implemented where risk is highest.
