きっかけ

パスワードマネージャーに期待する効果：手入力しない習慣を作り、不正なページに気づく

For websites outside of your control, encouraging your users to use password managers and allowing autocompletion of passwords in browsers can help. A password manager in a browser shouldn't provide a password for an incorrect site (although a user might still be persuaded to manually enter a password).

認証デバイスに期待する効果：パスワードが漏れても不正アクセスを防いでくれる

Cloudflare does not use TOTP codes. Instead, every employee at the company is issued a FIDO2-compliant security key from a vendor like YubiKey. Since the hard keys are tied to users and implement origin binding, even a sophisticated, real-time phishing operation like this cannot gather the information necessary to log in to any of our systems. While the attacker attempted to log in to our systems with the compromised username and password credentials, they could not get past the hard key requirement.