{"id":12570,"date":"2026-10-07T13:49:05","date_gmt":"2026-10-07T16:49:05","guid":{"rendered":"https:\/\/www.flane.com.pa\/blog\/?p=12570"},"modified":"2026-10-07T16:24:06","modified_gmt":"2026-10-07T19:24:06","slug":"mfa-resistente-a-phishing-fido2-webauthn","status":"publish","type":"post","link":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/","title":{"rendered":"MFA n\u00e3o \u00e9 tudo igual: por que FIDO2\/WebAuthn bloqueia o phishing"},"content":{"rendered":"<section class=\"l-section wpb_row height_small\"><div class=\"l-section-h i-cf\"><div class=\"g-cols vc_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><p data-lfile-container=\"65b3e7ce-4568-4130-89b6-5e87d20083b3\" data-pm-slice=\"1 1 &#091;&#093;\"><em>C\u00f3digo por SMS, push e chave de seguran\u00e7a resistem a ataques muito diferentes<\/em><\/p>\n<p data-lfile-container=\"65b3e7ce-4568-4130-89b6-5e87d20083b3\" data-pm-slice=\"1 1 &#091;&#093;\">Em 2025, 4,62 bilh\u00f5es de registros de roubo de identidade circularam na darknet, alta de 79% sobre 2024. Ativar a autentica\u00e7\u00e3o multifator reduz o valor de uma senha roubada, mas o resultado depende do fator escolhido. C\u00f3digo por SMS e notifica\u00e7\u00e3o push cedem a ataques que o FIDO2\/WebAuthn, o padr\u00e3o de MFA resistente a phishing, bloqueia pelo desenho do protocolo.<\/p>\n<\/div><\/div><div class=\"g-cols wpb_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ul>\n<li>\n<h4><strong><a href=\"https:\/\/www.flane.com.pa\/pt\/cyber-security\" target=\"_blank\" rel=\"noopener\">Torne-se um expert em Cyber Security com os treinamentos e certifica\u00e7\u00f5es que Fast Lane oferece\u00a0<\/a><\/strong><\/h4>\n<\/li>\n<li>\n<h4><a href=\"https:\/\/www.flane.com.pa\/blog\/pt\/newsletter\/\" target=\"_blank\" rel=\"noopener\">Assine a newsletter da TechTalk e fique informado de tudo.<\/a><\/h4>\n<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><\/div><\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 id=\"credencial-exposta-\u00e9-o-principal-combust\u00edvel-das-intrus\u00f5es\" data-lfile-container=\"65b3e7ce-4568-4130-89b6-5e87d20083b3\" data-pm-slice=\"1 1 &#091;&#093;\">Credencial exposta \u00e9 o principal combust\u00edvel das intrus\u00f5es<\/h3>\n<p>Em ambientes de nuvem, o comprometimento de identidade segue como vetor de intrus\u00e3o dominante. A maioria dos incidentes confirmados na nuvem em 2025 come\u00e7ou com credenciais roubadas, expostas ou mal utilizadas, sem explora\u00e7\u00e3o de infraestrutura.<\/p>\n<p>Os registros que circulam na darknet saem principalmente de malware que rouba credenciais (infostealers) e de listas combinadas de usu\u00e1rio e senha. Os logs costumam trazer dados do navegador da v\u00edtima, o que permite reutiliza\u00e7\u00e3o imediata, mais r\u00e1pida que for\u00e7a bruta ou password spraying. Eles alimentam tentativas de tomada de conta em VPN, portais de SSO e webmail.<\/p>\n<p>Na nuvem, quem entra com credencial v\u00e1lida opera dentro do comportamento esperado do provedor, sem malware e, muitas vezes, sem acionar os controles tradicionais. Nesse cen\u00e1rio, o segundo fator \u00e9 o controle que separa a senha roubada do acesso.<\/p>\n<h3 id=\"por-que-sms-e-push-falham\">Por que SMS e push falham<\/h3>\n<p>SMS e push t\u00eam uma fraqueza em comum: nada no processo amarra o fator ao site verdadeiro. O c\u00f3digo vale em qualquer p\u00e1gina em que for digitado, e a aprova\u00e7\u00e3o vale para qualquer pedido de login. Tr\u00eas ataques exploram isso.<\/p>\n<p><strong>SIM swap.<\/strong> O atacante convence a operadora a transferir o n\u00famero da v\u00edtima para outro chip. A partir da\u00ed, o c\u00f3digo por SMS chega ao aparelho dele.<\/p>\n<p><strong>MFA fatigue.<\/strong> Com a senha em m\u00e3os, o atacante dispara pedidos de aprova\u00e7\u00e3o push em sequ\u00eancia, at\u00e9 o usu\u00e1rio aceitar um por cansa\u00e7o ou engano. Exigir que o usu\u00e1rio digite no aplicativo o n\u00famero exibido na tela de login reduz esse risco, mas n\u00e3o impede o ataque seguinte.<\/p>\n<p><strong>Proxy reverso.<\/strong> A p\u00e1gina de phishing fica entre a v\u00edtima e o site verdadeiro e repassa tudo em tempo real. A v\u00edtima digita senha e c\u00f3digo, ou aprova o push, e o site leg\u00edtimo conclui o login. O proxy captura o cookie de sess\u00e3o e o atacante passa a usar a conta j\u00e1 autenticada. Do ponto de vista do site, o MFA foi cumprido corretamente.<\/p>\n<p>Al\u00e9m disso, as campanhas atuais chegam por QR code e por fluxos sem link, que levam a v\u00edtima para o celular e escapam dos filtros de URL do e-mail.<\/p>\n<\/div><\/div><div class=\"g-cols wpb_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ul>\n<li>\n<h4><strong><a href=\"https:\/\/www.flane.com.pa\/pt\/artificial-intelligence\" target=\"_blank\" rel=\"noopener\">Fast Lane oferece treinamentos de Intelig\u00eancia Artificial e Machine Learning dos principais fabricantes<\/a><\/strong><\/h4>\n<\/li>\n<li>\n<h4><a href=\"https:\/\/www.flane.com.pa\/blog\/pt\/newsletter\/\" target=\"_blank\" rel=\"noopener\">Assine a newsletter da TechTalk e fique informado de tudo<\/a><\/h4>\n<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><\/div><\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 id=\"como-o-fido2webauthn-quebra-o-ataque\" data-lfile-container=\"65b3e7ce-4568-4130-89b6-5e87d20083b3\" data-pm-slice=\"1 1 &#091;&#093;\">Como o FIDO2\/WebAuthn quebra o ataque<\/h3>\n<p>O FIDO2\/WebAuthn substitui o c\u00f3digo compartilhado por criptografia de chave p\u00fablica. Duas propriedades fazem dele o MFA resistente a phishing.<\/p>\n<p><strong>A chave privada nunca \u00e9 enviada ao site.<\/strong> No cadastro, o autenticador (uma chave de seguran\u00e7a f\u00edsica, o celular ou o notebook) gera um par de chaves exclusivo para aquele site. O servidor guarda s\u00f3 a chave p\u00fablica. A chave privada fica com o autenticador. No login, o servidor manda um desafio e o autenticador o assina depois de um toque, biometria ou PIN local. N\u00e3o existe c\u00f3digo para digitar, ditar por telefone ou interceptar.<\/p>\n<p><strong>A origem \u00e9 verificada.<\/strong> O navegador informa ao autenticador qual dom\u00ednio est\u00e1 pedindo o login, e a credencial s\u00f3 responde ao dom\u00ednio em que foi registrada. Em uma p\u00e1gina falsa, mesmo id\u00eantica \u00e0 original, o dom\u00ednio \u00e9 outro e a assinatura n\u00e3o acontece. O proxy reverso fica sem nada para repassar, e o usu\u00e1rio n\u00e3o precisa reconhecer o golpe para estar protegido.<\/p>\n<table>\n<colgroup>\n<col \/>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr>\n<th colspan=\"1\" rowspan=\"1\">Fator<\/th>\n<th colspan=\"1\" rowspan=\"1\">SIM swap<\/th>\n<th colspan=\"1\" rowspan=\"1\">MFA fatigue<\/th>\n<th colspan=\"1\" rowspan=\"1\">Proxy reverso<\/th>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">C\u00f3digo por SMS<\/td>\n<td colspan=\"1\" rowspan=\"1\">Vulner\u00e1vel<\/td>\n<td colspan=\"1\" rowspan=\"1\">N\u00e3o se aplica<\/td>\n<td colspan=\"1\" rowspan=\"1\">Vulner\u00e1vel<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">Notifica\u00e7\u00e3o push<\/td>\n<td colspan=\"1\" rowspan=\"1\">N\u00e3o se aplica<\/td>\n<td colspan=\"1\" rowspan=\"1\">Vulner\u00e1vel<\/td>\n<td colspan=\"1\" rowspan=\"1\">Vulner\u00e1vel<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\">FIDO2\/WebAuthn<\/td>\n<td colspan=\"1\" rowspan=\"1\">N\u00e3o se aplica<\/td>\n<td colspan=\"1\" rowspan=\"1\">N\u00e3o se aplica<\/td>\n<td colspan=\"1\" rowspan=\"1\">Resiste<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>O FIDO2 protege o momento do login. Depois dele, a sess\u00e3o passa a ser representada por um cookie ou token, que um infostealer pode copiar do navegador e reutilizar. Por isso, revogar sess\u00f5es e tokens continua sendo parte da defesa.<\/p>\n<\/div><\/div><div class=\"g-cols wpb_row via_flex valign_top type_default stacking_default\"><div class=\"vc_col-sm-12 wpb_column vc_column_container\"><div class=\"vc_column-inner\"><div class=\"wpb_wrapper\"><div class=\"w-separator size_medium\"><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><ul>\n<li>\n<h4><strong><a href=\"https:\/\/www.flane.com.pa\/pt\/software-development\" target=\"_blank\" rel=\"noopener\">Quer aprender a desenvolver softwares? A Fast Lane oferece um portf\u00f3lio de treinamentos e certifica\u00e7\u00f5es l\u00edder de mercado. Confira aqui.<\/a><\/strong><\/h4>\n<\/li>\n<li>\n<h4><a href=\"https:\/\/www.flane.com.pa\/blog\/pt\/newsletter\/\" target=\"_blank\" rel=\"noopener\">Assine a newsletter da TechTalk e fique informado de tudo.<\/a><\/h4>\n<\/li>\n<\/ul>\n<\/div><\/div><div class=\"w-separator size_medium\"><\/div><\/div><\/div><\/div><\/div><div class=\"wpb_text_column\"><div class=\"wpb_wrapper\"><h3 id=\"quando-n\u00e3o-d\u00e1-para-migrar-tudo-comece-pelas-contas-privilegiadas\" data-lfile-container=\"65b3e7ce-4568-4130-89b6-5e87d20083b3\" data-pm-slice=\"1 1 &#091;&#093;\">Quando n\u00e3o d\u00e1 para migrar tudo, comece pelas contas privilegiadas<\/h3>\n<p>Se a troca n\u00e3o puder ser feita de uma vez, a ordem de migra\u00e7\u00e3o segue o dano que cada conta pode causar.<\/p>\n<ol>\n<li><strong>Contas raiz de nuvem e administradores de identidade e SSO.<\/strong> Conta raiz sem MFA encurta o caminho entre o acesso e o impacto.<\/li>\n<li><strong>Acesso remoto.<\/strong> VPN corporativa e RDP s\u00e3o os tipos de acesso mais anunciados \u00e0 venda por corretores de acesso inicial.<\/li>\n<li><strong>Demais usu\u00e1rios<\/strong>, a come\u00e7ar por quem acessa dados sens\u00edveis.<\/li>\n<\/ol>\n<p>Para contas privilegiadas, prefira chaves de seguran\u00e7a f\u00edsicas, em que a chave privada fica presa ao hardware. Passkeys sincronizadas replicam a chave, cifrada, entre os aparelhos do mesmo usu\u00e1rio. Isso facilita a recupera\u00e7\u00e3o, mas faz a prote\u00e7\u00e3o depender tamb\u00e9m da conta que sincroniza.<\/p>\n<p>Enquanto SMS ou push continuarem ativos, trate-os como controle provis\u00f3rio. Exija a digita\u00e7\u00e3o do n\u00famero no push, limite as tentativas e monitore login bem-sucedido depois de falhas repetidas ou de v\u00e1rios desafios de MFA.<\/p>\n<h3 id=\"checklist-6-itens-para-avaliar-o-mfa-da-sua-empresa-hoje\">Checklist: 6 itens para avaliar o MFA da sua empresa hoje<\/h3>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol data-lfile-container=\"65b3e7ce-4568-4130-89b6-5e87d20083b3\" data-pm-slice=\"3 1 &#091;&#093;\">\n<li><strong>Invent\u00e1rio de fatores.<\/strong> Sabemos quais contas usam SMS, push e FIDO2\/WebAuthn?<\/li>\n<li><strong>Cobertura.<\/strong> Existe conta sem MFA nenhum, como conta raiz de nuvem, conta de servi\u00e7o ou conta de emerg\u00eancia? A aplica\u00e7\u00e3o inconsistente do MFA \u00e9 uma das condi\u00e7\u00f5es que os ataques de for\u00e7a bruta exploram.<\/li>\n<li><strong>Contas privilegiadas.<\/strong> Todos os administradores autenticam com FIDO2\/WebAuthn?<\/li>\n<li><strong>Fallback e recupera\u00e7\u00e3o.<\/strong> Quem j\u00e1 usa FIDO2 ainda pode cair para SMS ou recuperar a conta por um processo mais fraco?<\/li>\n<li><strong>Prote\u00e7\u00e3o do push.<\/strong> Onde o push permanece, h\u00e1 digita\u00e7\u00e3o de n\u00famero e limite de tentativas?<\/li>\n<li><strong>Sess\u00e3o e resposta.<\/strong> Conseguimos revogar sess\u00f5es e tokens de uma conta comprometida, e medimos quanto tempo isso leva?<\/li>\n<\/ol>\n<p>Cada &#8220;n\u00e3o&#8221; ou &#8220;n\u00e3o sei&#8221; vira um item de trabalho com dono e prazo. Os itens 2 e 3 v\u00eam primeiro.<\/li>\n<\/ol>\n<h3><span style=\"font-family: inherit;\">Participe do CyberSprint<\/span><\/h3>\n<p>At\u00e9 31\/10, n\u00f3s liberamos uma pergunta de ciberseguran\u00e7a por dia no CyberSprint, a campanha da Fast Lane para o m\u00eas da ciberseguran\u00e7a. Participe do CyberSprint, responda uma pergunta por dia e concorra a um drone DJI Mini 4K: <a href=\"https:\/\/cybersprint.fastlanehub.tech\/\">Inscreva-se aqui!<\/a><\/p>\n<hr \/>\n<p>Fonte: Relat\u00f3rio do Cen\u00e1rio Global de Amea\u00e7as 2026, FortiGuard Labs \/ Fortinet, 2026. Funcionamento do protocolo conforme as especifica\u00e7\u00f5es p\u00fablicas WebAuthn (W3C) e FIDO2 (FIDO Alliance).<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/section>\n","protected":false},"excerpt":{"rendered":"C\u00f3digo por SMS, push e chave de seguran\u00e7a resistem a ataques muito diferentes Em 2025, 4,62 bilh\u00f5es de registros de roubo de identidade circularam na darknet, alta de 79% sobre 2024. Ativar a autentica\u00e7\u00e3o multifator reduz o valor de uma senha roubada, mas o resultado depende do fator escolhido. C\u00f3digo por SMS e notifica\u00e7\u00e3o push...","protected":false},"author":15,"featured_media":12575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1872,1926,1],"tags":[6404,5760,3091,6408,6406,1848,6420,6295,6386,6422,4038,4182,6418,6325,5057,6412,6384,6390,4174,6414,6309,6416,1860,6410,6388],"class_list":["post-12570","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-pt","category-fastlane-pt","category-uncategorized","tag-2fa","tag-autenticacao-de-dois-fatores","tag-autenticacao-multifator","tag-autenticacao-sem-senha","tag-chave-de-seguranca","tag-ciberseguranca-pt","tag-contas-privilegiadas","tag-cybersprint-pt","tag-fido2","tag-gestao-de-identidade","tag-iam","tag-identidade-e-acesso","tag-infostealer","tag-mes-da-ciberseguranca-2026","tag-mfa","tag-mfa-fatigue","tag-mfa-resistente-a-phishing","tag-passkeys","tag-phishing-pt","tag-proxy-reverso","tag-roubo-de-credenciais","tag-roubo-de-sessao","tag-seguranca-da-informacao-pt","tag-sim-swap","tag-webauthn"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>MFA resistente a phishing: o que muda com FIDO2 e WebAuthn<\/title>\n<meta name=\"description\" content=\"SMS, push e chave de seguran\u00e7a resistem a ataques diferentes. Veja por que FIDO2\/WebAuthn \u00e9 o MFA resistente a phishing e como avaliar o da sua empresa.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"MFA resistente a phishing: o que muda com FIDO2 e WebAuthn\" \/>\n<meta property=\"og:description\" content=\"SMS, push e chave de seguran\u00e7a resistem a ataques diferentes. Veja por que FIDO2\/WebAuthn \u00e9 o MFA resistente a phishing e como avaliar o da sua empresa.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/\" \/>\n<meta property=\"og:site_name\" content=\"TechTalk powered by Fast Lane LATAM\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/FastLane.br\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-07T16:49:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-07T19:24:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Mayara Pimentel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@FastLaneBr\" \/>\n<meta name=\"twitter:site\" content=\"@FastLaneBr\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mayara Pimentel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/\"},\"author\":{\"name\":\"Mayara Pimentel\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#\\\/schema\\\/person\\\/137dd93330c10cbd683159ae4b4ff9c4\"},\"headline\":\"MFA n\u00e3o \u00e9 tudo igual: por que FIDO2\\\/WebAuthn bloqueia o phishing\",\"datePublished\":\"2026-10-07T16:49:05+00:00\",\"dateModified\":\"2026-10-07T19:24:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/\"},\"wordCount\":1321,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg\",\"keywords\":[\"2FA\",\"autentica\u00e7\u00e3o de dois fatores\",\"autentica\u00e7\u00e3o multifator\",\"autentica\u00e7\u00e3o sem senha\",\"chave de seguran\u00e7a\",\"Ciberseguran\u00e7a\",\"contas privilegiadas\",\"CyberSprint\",\"FIDO2\",\"gest\u00e3o de identidade\",\"IAM\",\"identidade e acesso\",\"infostealer\",\"m\u00eas da ciberseguran\u00e7a 2026\",\"MFA\",\"MFA fatigue\",\"MFA resistente a phishing\",\"passkeys\",\"phishing\",\"proxy reverso\",\"roubo de credenciais\",\"roubo de sess\u00e3o\",\"seguran\u00e7a da informa\u00e7\u00e3o\",\"SIM swap\",\"WebAuthn\"],\"articleSection\":[\"Cyber Security\",\"Fast Lane\",\"Uncategorized\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/\",\"name\":\"MFA resistente a phishing: o que muda com FIDO2 e WebAuthn\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg\",\"datePublished\":\"2026-10-07T16:49:05+00:00\",\"dateModified\":\"2026-10-07T19:24:06+00:00\",\"description\":\"SMS, push e chave de seguran\u00e7a resistem a ataques diferentes. Veja por que FIDO2\\\/WebAuthn \u00e9 o MFA resistente a phishing e como avaliar o da sua empresa.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg\",\"width\":1280,\"height\":720,\"caption\":\"Envelope de papel fisgado por um anzol sobre o teclado de um notebook, representando um ataque de phishing por e-mail para roubo de credenciais.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/pt\\\/mfa-resistente-a-phishing-fido2-webauthn\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"MFA n\u00e3o \u00e9 tudo igual: por que FIDO2\\\/WebAuthn bloqueia o phishing\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/\",\"name\":\"TechTalk powered by Fast Lane LATAM\",\"description\":\"Sharing ideas and knowledge on IT training and certification\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#organization\",\"name\":\"Fast Lane Brasil\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/fast-lane-ng3.png\",\"contentUrl\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/fast-lane-ng3.png\",\"width\":209,\"height\":31,\"caption\":\"Fast Lane Brasil\"},\"image\":{\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/FastLane.br\",\"https:\\\/\\\/x.com\\\/FastLaneBr\",\"https:\\\/\\\/www.instagram.com\\\/fastlane.br\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/fastlanebr\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/#\\\/schema\\\/person\\\/137dd93330c10cbd683159ae4b4ff9c4\",\"name\":\"Mayara Pimentel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g\",\"caption\":\"Mayara Pimentel\"},\"sameAs\":[\"https:\\\/\\\/www.instagram.com\\\/mayara.piimentel\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/mayara-pimentel\\\/\"],\"url\":\"https:\\\/\\\/www.flane.com.pa\\\/blog\\\/author\\\/mayarap\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"MFA resistente a phishing: o que muda com FIDO2 e WebAuthn","description":"SMS, push e chave de seguran\u00e7a resistem a ataques diferentes. Veja por que FIDO2\/WebAuthn \u00e9 o MFA resistente a phishing e como avaliar o da sua empresa.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/","og_locale":"pt_BR","og_type":"article","og_title":"MFA resistente a phishing: o que muda com FIDO2 e WebAuthn","og_description":"SMS, push e chave de seguran\u00e7a resistem a ataques diferentes. Veja por que FIDO2\/WebAuthn \u00e9 o MFA resistente a phishing e como avaliar o da sua empresa.","og_url":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/","og_site_name":"TechTalk powered by Fast Lane LATAM","article_publisher":"https:\/\/www.facebook.com\/FastLane.br","article_published_time":"2026-10-07T16:49:05+00:00","article_modified_time":"2026-10-07T19:24:06+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg","type":"image\/jpeg"}],"author":"Mayara Pimentel","twitter_card":"summary_large_image","twitter_creator":"@FastLaneBr","twitter_site":"@FastLaneBr","twitter_misc":{"Escrito por":"Mayara Pimentel","Est. tempo de leitura":"7 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/#article","isPartOf":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/"},"author":{"name":"Mayara Pimentel","@id":"https:\/\/www.flane.com.pa\/blog\/#\/schema\/person\/137dd93330c10cbd683159ae4b4ff9c4"},"headline":"MFA n\u00e3o \u00e9 tudo igual: por que FIDO2\/WebAuthn bloqueia o phishing","datePublished":"2026-10-07T16:49:05+00:00","dateModified":"2026-10-07T19:24:06+00:00","mainEntityOfPage":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/"},"wordCount":1321,"commentCount":0,"publisher":{"@id":"https:\/\/www.flane.com.pa\/blog\/#organization"},"image":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/#primaryimage"},"thumbnailUrl":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg","keywords":["2FA","autentica\u00e7\u00e3o de dois fatores","autentica\u00e7\u00e3o multifator","autentica\u00e7\u00e3o sem senha","chave de seguran\u00e7a","Ciberseguran\u00e7a","contas privilegiadas","CyberSprint","FIDO2","gest\u00e3o de identidade","IAM","identidade e acesso","infostealer","m\u00eas da ciberseguran\u00e7a 2026","MFA","MFA fatigue","MFA resistente a phishing","passkeys","phishing","proxy reverso","roubo de credenciais","roubo de sess\u00e3o","seguran\u00e7a da informa\u00e7\u00e3o","SIM swap","WebAuthn"],"articleSection":["Cyber Security","Fast Lane","Uncategorized"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/","url":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/","name":"MFA resistente a phishing: o que muda com FIDO2 e WebAuthn","isPartOf":{"@id":"https:\/\/www.flane.com.pa\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/#primaryimage"},"image":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/#primaryimage"},"thumbnailUrl":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg","datePublished":"2026-10-07T16:49:05+00:00","dateModified":"2026-10-07T19:24:06+00:00","description":"SMS, push e chave de seguran\u00e7a resistem a ataques diferentes. Veja por que FIDO2\/WebAuthn \u00e9 o MFA resistente a phishing e como avaliar o da sua empresa.","breadcrumb":{"@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/#primaryimage","url":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg","contentUrl":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2026\/10\/MFA-nao-e-tudo-igual-por-que-FIDO2WebAuthn-bloqueia-o-phishing-1.jpg","width":1280,"height":720,"caption":"Envelope de papel fisgado por um anzol sobre o teclado de um notebook, representando um ataque de phishing por e-mail para roubo de credenciais."},{"@type":"BreadcrumbList","@id":"https:\/\/www.flane.com.pa\/blog\/pt\/mfa-resistente-a-phishing-fido2-webauthn\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.flane.com.pa\/blog\/es\/"},{"@type":"ListItem","position":2,"name":"MFA n\u00e3o \u00e9 tudo igual: por que FIDO2\/WebAuthn bloqueia o phishing"}]},{"@type":"WebSite","@id":"https:\/\/www.flane.com.pa\/blog\/#website","url":"https:\/\/www.flane.com.pa\/blog\/","name":"TechTalk powered by Fast Lane LATAM","description":"Sharing ideas and knowledge on IT training and certification","publisher":{"@id":"https:\/\/www.flane.com.pa\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.flane.com.pa\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/www.flane.com.pa\/blog\/#organization","name":"Fast Lane Brasil","url":"https:\/\/www.flane.com.pa\/blog\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.flane.com.pa\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2019\/10\/fast-lane-ng3.png","contentUrl":"https:\/\/www.flane.com.pa\/blog\/wp-content\/uploads\/2019\/10\/fast-lane-ng3.png","width":209,"height":31,"caption":"Fast Lane Brasil"},"image":{"@id":"https:\/\/www.flane.com.pa\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/FastLane.br","https:\/\/x.com\/FastLaneBr","https:\/\/www.instagram.com\/fastlane.br\/","https:\/\/www.linkedin.com\/company\/fastlanebr"]},{"@type":"Person","@id":"https:\/\/www.flane.com.pa\/blog\/#\/schema\/person\/137dd93330c10cbd683159ae4b4ff9c4","name":"Mayara Pimentel","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2b3587a15e9883ddffd48fb9d5bb7a23f4e90d20357a2eb97901b3cfbfcf7833?s=96&d=mm&r=g","caption":"Mayara Pimentel"},"sameAs":["https:\/\/www.instagram.com\/mayara.piimentel\/","https:\/\/www.linkedin.com\/in\/mayara-pimentel\/"],"url":"https:\/\/www.flane.com.pa\/blog\/author\/mayarap\/"}]}},"_links":{"self":[{"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/posts\/12570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/comments?post=12570"}],"version-history":[{"count":3,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/posts\/12570\/revisions"}],"predecessor-version":[{"id":12576,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/posts\/12570\/revisions\/12576"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/media\/12575"}],"wp:attachment":[{"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/media?parent=12570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/categories?post=12570"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.flane.com.pa\/blog\/wp-json\/wp\/v2\/tags?post=12570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}