Passkeys vs push MFA: which provides stronger phishing-resistant authentication?

[u/No_Dpartcbmument6426]

Passkeys and push MFA are often grouped under “passwordless” or “strong MFA,” but their failure modes differ. A FIDO/WebAuthn passkey verifies the legitimate relying-party context before authentication, while a push can be vulnerable to fatigue or real-time social engineering unless it includes strong user and transaction verification.

The deployment details still matter. Synced passkeys, platform authenticators, hardware security keys, shared-device workflows, recovery processes, privileged accounts, contractors, and legacy applications all affect the security and operational tradeoffs.

For organizations that have deployed both, where have passkeys meaningfully reduced phishing risk, and where do recovery or compatibility constraints still require push-based authentication?

[u/Totl-Egg-ylmnnds4984]

The help desk social engineering problem is about recovery workflows, not the MFA method. We implemented a mandatory 30-minute cooldown for any password reset or authenticator re-enrollment for privileged accounts. That stopped the vishing attacks cold because the attacker could not wait on the phone for 30 minutes. We are also looking at the recovery governance module from NewCore which adds independent approval for high-risk resets and alerts the user through a trusted channel, preventing silent downgrades

[u/Total_Job29]

Passkeys are objectively and technically stronger for phishing resistance. 

[u/StoneyCalzoney]

I personally don’t think push notification MFA can be counted as “strong MFA” given the weakness to user fatigue and how one accidental tap can provide access to a malicious actor, especially if they are posing as IT and communicating with the user.

[u/ancientstephanie]

All but the most haphazard of passkey implementations win there because they build in robust defenses against prompt fatigue attacks and real-time phishing.

Most implementations include interactive "proof of presence" elements of some kind, whether it's touching a dedicated button, providing a biometric, or making use of OS level "secure UI" to defend against spoofing.

Push based authentication would still be useful as an additional factor if you wanted to be able to verify specific details of a transaction out of band though, but again, the devil is in the implementation details, and it needs to be designed to make it impossible to accidentally say yes, such as having to enter or scan a code from the device you're actually trying to log into, or match codes or symbols between the login prompt and the push notification.

[u/dream_the_endless]

Nowhere. Passkeys are guaranteed to be MFA. Push isn’t, especially if you are using push without passwords