Multi-factor authentication: Behavior and lifecycle
Short-lived MFA challenges bind to a pending session, step-up gates sensitive actions, recovery codes are single-use, and a password replay cannot skip an in-progress or required second factor.
WebAuthn passkey registration binds credentials to the authenticated account with discoverable ceremony options, bounded challenges, and recovery paths that do not promise private-key extraction.