DEF CON 33 - Passkeys Pwned:Turning WebAuthn Against Itself - S Pratap Singh, J Lin, D Seetoh

This talk reveals critical security vulnerabilities in passkeys that could compromise authentication systems 0:15.

Key Takeaways:
• Passkeys are being widely adopted due to phishing protection, non-guessability, and reduced impact of data breaches, but lack decades of security research that passwords have undergone 1:33-3:41
• The WebAuthn flow creates a new attack surface where the browser acts as a trust anchor between the authenticator and server, making it an attractive target 11:39-12:03
• Researchers demonstrated how a malicious browser extension can hook into the credentials API, intercept passkey registration, and forge authentication responses without user biometrics 12:19-14:03
• The attack works silently across devices, with the extension even displaying normal biometric prompts while using the attacker's stored credentials 20:00-21:41
• Mitigation strategies include proper CSP policies, thorough verification processes, preventing XSS attacks, and being vigilant about browser extension permissions 27:22-33:35

The browser has effectively become the new operating system, requiring the same security controls we traditionally applied to local applications.

Sources:

• 0:15 Introduction to the topic of passkey vulnerabilities
• 1:33-3:41 Why companies are pushing passkeys and their advantages
• 11:39-12:03 How the browser becomes the trust anchor in passkey authentication
• 12:19-14:03 Explanation of the browser extension atta