Authentication Strength Downgraded Through Method Replacement

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•9

Detects the deletion of a phishing-resistant authentication method (like FIDO2 security key or passkey) followed by the registration of a weaker authentication method (like a phone authentication method or software OATH token) for the same account. This pattern indicates a potential downgrade attack on an account's authentication security.