00:00:00–00:00:05
MFA is on.
Are all methods equal?

00:00:05–00:00:10
Codes can be phished
and relayed.

00:00:10–00:00:15
FIDO/WebAuthn credentials
are scoped to a site’s domain.

00:00:15–00:00:20
Prefer phishing-resistant methods
where supported.

00:00:20–00:00:25
Check fallback sign-ins and recovery.
Phishing resistance has limits.