Passkeys Pwned: Turning WebAuthn Against Itself
Demonstrates architectural and implementation weaknesses in commercial passkey syncing and WebAuthn relying party implementations.
Summary
The Industry Push for Passwordless Passkeys
Passkeys and WebAuthn are widely adopted across consumer platforms to eliminate password-based attacks and provide phishing-resistant authentication.
Auditing Relying Party Implementations
S Pratap Singh, J Lin, and D Seetoh evaluate how major online services implement WebAuthn server-side verification, discovering widespread flaws in challenge-response validation and session binding.
Credential Takeover via Passkey Registration Flaws
Flaws in multi-factor recovery workflows and flawed fallback mechanisms allow attackers to register unauthorized passkeys onto victim accounts or abuse synchronization flaws in cloud passkey vaults.
Building Resilient Passkey Architectures
Enterprises deploying WebAuthn must enforce strict challenge validation, bind passkey sessions to verified client devices, and maintain secure account recovery fallbacks.
Related talks
Creator Stage·24 min
Chad Spensky
Demonstrates an effective phishing attack vector against synced passkeys and outlines operational safeguards for enterprise passkey deployments.
Main Stage·37 min
M Casagrande · D Antonioli
Presents CTRAPS, a novel class of API confusion and impersonation attacks targeting the Client to Authenticator Protocol (CTAP) in FIDO2 hardware keys.
Main Stage·1 hr 7 min
Ofir Arkin
Ofir Arkin explores knac at DEF CON 15, examining network-access-control and practical defenses.