Phishing-resistant by design (bound to the legitimate domain) > - **Number matching** — For push notifications, require the user to enter a number shown on the login screen (prevents push bombing) > - **Certificate-based authentication** — Ties authentication to a specific device certificate > - **C