DEF CON 34 - Main - Beyond the Ceremony - The 2026 Passkey Attack Surface - Matteo Giordano
Source: YouTube · DEFCONConference · published Nov 6, 2026 · 35:36
This DEF CON talk by Matteo Jordano (Anvil Secure) argues passkeys are cryptographically sound but real attacks target the surrounding environment—authenticators, clients, servers, cloud sync, and humans 4:35.
Key Takeaways:
• Passkey adoption is growing (~5B accounts, 68% of orgs), but rarely as the sole method—most rely on fallback auth 3:41
• Hybrid transport (QR + BLE) is vulnerable to real-time phishing by attackers within Bluetooth range; FIDO 2.3 still lets RPs distinguish proxy ceremonies 13:55
• A study of 103 relying parties found ~100% vulnerable to at least one server-side attack (signature swap, algorithm downgrade, credential ID tampering) 19:16
• The speaker demos his Burp Suite extension for decoding and tampering with passkey traffic, e.g., planting attacker-controlled keys 20:45
• Cloud sync shifts trust to weaker provider auth—old attacks like SIM swapping now target the cloud account 28:25
• Biometrics verify presence, not identity, so partners or co-workers with device access can gain stealthy persistent access 32:43
Passkeys didn't eliminate the attack surface—they moved it; defenders must scrutinize the whole ecosystem. The tool is live, with a white paper forthcoming 34:48.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Welcome everybody to track 2 11 o'clock talk uh beyond the ceremony the 2026 pass key attack surface our friend Mateo u like to welcome him up to the stage sir. [applause] All right, folks. How you all doing? Welcome to the 2026 Pascia attack surface, which sounds like a quite ambitious goal for a 45minute tall, right? But let me show you why that is such a tall order. So at a high level, a Pasi is something that originate inside an authenticator and it consists of two parts, a private one and a public one that we all know very well, right? And those split up almost immediately. one part is kept private on the authenticator while the other one the public one is pretty much sent to the relying party so the server and then in the middle we have um the client which is very often the browser w…