Your Passkey is Weak: Phishing the Unphishable
Demonstrates an effective phishing attack vector against synced passkeys and outlines operational safeguards for enterprise passkey deployments.
Summary
The Promise and Reality of Passkeys
FIDO2 passkeys are widely promoted as the definitive solution to phishing, leveraging public-key cryptography and origin-bound credentials to prevent credential harvesting attacks.
Phishing Vectors Against Synced Passkeys
Chad Spensky demonstrates a practical attack chain targeting consumer-synced passkey ecosystems. By manipulating device enrollment flows and user trust assumptions, attackers can induce users into delegating access or pairing unauthorized synchronization devices.
Social Engineering and Device Pairing Exploits
Attacking the passkey ecosystem shifts the adversary focus from password harvesting to credential syncing mechanisms, QR-code authentication flows, and account recovery handoffs.
Recommendations for Secure Passkey Implementation
Enterprises adopting passkeys must configure strict device attestation policies, mandate hardware security keys for high-privilege roles, and educate users on verifying cross-device pairing prompts.
Related talks
Main Stage·43 min
Keanu Nys
Demonstrates how red teams can abuse legitimate Microsoft login branding parameters and OAuth endpoints to host convincing, high-trust phishing infrastructure.
Social Engineering Village·51 min
Chris Silvers, Taylor Banks
DEF CON SECTF champions demonstrate advanced hunting techniques—combining phishing, OSINT, and red team tactics to track and engage targets.
Creator Stage·56 min
Brent White · Tim Roberts
Shares hard-learned lessons and busted myths from physical penetration tests, covering site surveys, social engineering, and real-time contingency handling.