Stop Telling People Not To Click Links
Tailscale CEO argues link-clicking is not the problem; deploying phishing-resistant authentication like passkeys and WebAuthn eliminates entire attack classes.
Tailscale CEO Avery Pennarun argues in an opinion piece that clicking links is a symptom, not the disease, and that weak authentication is the real failure behind phishing damage. He advocates phishing-resistant FIDO/WebAuthn, passkeys, and device-bound tokens, plus continuous identity-anchored network access so unexpected login prompts become suspicious signals. He argues this approach makes security less burdensome for users while neutralizing credential replay and fake login pages.
- Link clicks are harmless pointers; damage stems from weak authentication and replayable credentials
- Phishing-resistant WebAuthn and passkeys eliminate fake login page and credential theft outcomes
- Anchoring access on identity lets authorization become explicit and auditable
- Unexpected login prompts become meaningful warnings when authentication is normally invisible
From the original article
4 min read at forbes.com
Avery Pennarun, CEO of Tailscale . He writes about secure networking, infrastructure, and building systems that make technology simpler. I've been in the same security conversation many times: Someone brings up phishing, someone else pulls up the clickthrough rate from the last simulation, and we all start brainstorming ways to reduce the number of clicks.
By forbes.com via typesanitizer · forbes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.