Quiz Entry - updated: 2026.10.22
Which threats arise when authenticators fall into the wrong hands, and how can each be mitigated?
NIST lists threats such as theft, duplication, eavesdropping, offline cracking, side-channel attacks, phishing, social engineering, authentication fatigue, online guessing and endpoint compromise, and pairs each with a mitigation, mostly MFA, hardware-protected keys, phishing resistance and rate limiting.
| Threat | Example | Mitigation |
|---|---|---|
| Theft | A hardware token or phone is stolen | Multi-factor authenticators activated by PIN or biometric |
| Duplication | A password written down or a software key copied | Authenticators whose secrets are hard to extract |
| Eavesdropping | Keylogger, PIN pad skimmer, observing the keyboard | Malware-free endpoints, protected channels, replay-resistant protocols |
| Offline cracking | Dictionary attack on a stolen password hash | High-entropy secrets; salted, slow, keyed hashing |
| Side-channel attack | Key extracted by power or timing analysis | Constant-time, constant-power algorithms |
| Phishing or pharming | Password typed into a fake bank site | Phishing-resistant authenticators |
| Social engineering | "IT support" calls and asks for the code | Avoid authenticators that third parties can be talked into resetting |
| Authentication fatigue | User approves a flood of push prompts | Require transferring a secret (number matching) instead of a plain approve |
| Online guessing | Trying common passwords at the login form | High-entropy outputs, lockout and rate limiting |
| Endpoint compromise | Malware uses a connected token remotely | Hardware authenticators that need a physical action (a touch) |
Further entries cover unauthorised binding of an attacker's authenticator, keys left on sold devices, keys copied to too many devices or through insecure cloud sync, and insider threats at the provider.
Go deeper:
NIST SP 800-63B-4: Authenticator threats — the complete threat table with examples (section 6.1).- NIST SP 800-63B-4: Threat mitigation strategies — the matching mitigation table (section 6.2).