Bleeping Computer
9.5 — CRITICAL
39 New Methods That Compromise Passkey Authentication
Passkeys eliminate many password-based attacks, but researchers have documented 39 methods for compromising authentication built around them. Token explains how attackers can abuse authentication prompts, synced credentials, enrollment, recovery, and other trust boundaries without breaking FIDO2 cryptography. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Passkey authentication has become a target for attackers, with at least 39 documented methods exploiting its infrastructure and trust boundaries. The attack surface is expanding due to shared passkeys, synchronization, and enrollment processes.
⚙️Technical Details
Affected Systems
WebAuthn infrastructureWindows applicationsPassword managersCloud synchronization servicesMobile devices
Attack Vectors
Assertion miningAssertion replayCircuit breaker attacksAssertion phishingBrowser hookingAssertion captureChallenge injectionDetour replayUser verification manipulationUser presence manipulation
💥Impact Assessment
Severity: Critical
Who Is at Risk
Employees using passkey authenticationOrganizations with shared passkeys or synchronized accountsSeverity: Critical
🛡️Recommended Actions
1Implement dedicated biometric hardware for passkey authentication
2Regularly review and update account recovery processes
3Use secure password managers and monitor for suspicious activity
📦Affected Products
WebAuthn infrastructureWindows applicationsPassword managersCloud synchronization services
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.