Attacks · Credentials & humans
Stolen ceremony fragments do not replay as ambient credentials. There is no lasting credential to harvest, and endpoint binding rejects relayed proofs on other routes.
~6 min readContinue: Ambient credentials
The phisher wants the victim to reveal something that authorizes the attacker elsewhere: a password, OTP, bearer, recovery code, or ceremony fragment that converts into a second session. The conversion is harvest-to-caller — trick the human, then reuse the string as ambient authority on a different device or route. Phishing remains a human problem; this page only denies the ambient conversion that makes the lure cash out as lasting login.
Password and OTP phishing works because the harvested string is ambient authority by design. Passkeys reduce some harvest paths but still bind users to device and vendor recovery stories that can reintroduce transferable factors. Ambient estates train users to type secrets into forms; attackers only need a convincing lure and a place to paste what comes back. Ceremony UX residual risks are deferred — here the mechanism claim is “no reusable tray,” not “users never click.”
ENI6MA removes the lasting credential tray. Ceremony fragments are one-shot and request-bound; endpoint binding means a relayed proof fails on any other route. Conversion from phish tray to lasting caller fails. This is mechanism denial of ambient harvest — not a lecture that users will never click — and it pairs with keylogging and relay families for the full human-facing story. Endpoint binding closes the relayed-fragment path that would otherwise turn a harvested ceremony into another route’s caller.
Read the dual plates as ambient success versus mechanism denial for phishing: the surface plate shows why classical estates pay; the denial plate shows which ENI6MA check family stops the conversion without dumping an NDA attack-to-stage matrix. Claims below stay model-scoped.
Phish harvests reusable secrets
How to read: lure tray left; harvest-and-reuse ambient win right. Takeaway: harvest equals lasting credential.
Ambient phishing pays when the lure catches a string that works again later.
Nothing reusable to harvest
How to read: lasting-credential myths fail; ceremony fragment is request-bound. Takeaway: no lasting credential; binding holds.
One-shot, bound fragments leave the lure with nothing reusable to cash out.
Immune to phishing.ValidatedNo reusable credential exists to harvest; endpoint_id binding means a relayed proof fails on any other route.Holds under the reference architecture
Mechanism denial of ambient harvest — not a UX lecture.
This essay critiques the systemic problems not addressed by contemporary passwordless trends (passkeys, FIDO tokens, and mobile MFA apps). While hardware-bound credentials reduce phishing and stuffing for interactive users, the author argues they bind users to specific devices and vendor escrow or sync services, ceding sovereignty over storage and recovery.
Phishing immunity here means no reusable ambient authorizer to harvest into a second session under the reference ceremony.