phishing resistant auth

Phishing resistant auth refers to authentication methods that cannot be bypassed by tricking a user into revealing credentials on a fake website. On Windows, Windows Hello PINs are a prime example: the PIN itself is never sent over the network; instead, it unlocks a device-bound private key stored in the TPM. This asymmetric key pair is tied to the specific device, making stolen credentials useless elsewhere. Unlike passwords, which are shared secrets vulnerable to phishing and breaches, phishing resistant auth relies on cryptographic proof of device possession. Windows Hello leverages TPM hardware to protect keys and resist brute-force attacks, ensuring that even if a user types their PIN on a phishing site, the attacker gains nothing useful.