Breaking Lab srl
The Passkey Promise Under Pressure
For several years, the security industry has been confidently steering users and enterprises away from passwords and toward passkeys — cryptographic credentials tied to a device or a cloud-synced vault that, in theory, cannot be phished. That confidence took a significant hit last week when three separate research teams, working independently, demonstrated practical techniques to defeat passkey authentication without ever touching the underlying public-key cryptography that underpins the standard.
The findings matter because passkeys have been positioned not merely as a convenience upgrade but as a structural fix to one of the most persistent problems in security: credential theft. If the structural fix has cracks, the industry needs to know about them now, while adoption is still accelerating rather than after passkeys have become the universal default.
Three Attack Paths, One Uncomfortable Theme
The three techniques uncovered by researchers share a telling common thread — none of them attempt to reverse the cryptographic operations that make passkeys mathematically strong. Instead, they exploit the ecosystem around passkeys: the operating systems that generate authentication tokens, the cloud services that sync credentials across devices, and the multi-factor authentication flows that passkeys are often used to reinforce.
The first attack reused signed authentication material that Windows had exposed during a legitimate sign-in session. Rather than forging a signature from scratch, the attacker recycled a valid, already-signed challenge response — effectively replaying a genuine authentication event in a context the victim never intended.
The second technique targeted cloud-synced passkey systems. An attacker who had already established a foothold on a victim’s machine through malware was able to extract the synced private key material from the cloud synchronisation mechanism before it could be protected by device-bound attestation. The implication is stark: if malware is already present, the “phishing-resistant” label may not extend to the full credential lifecycle.
The third approach bypassed phishing-resistant MFA by exploiting the logic of the authentication flow itself rather than the cryptographic primitives. Researchers found a way to intercept or redirect the authentication dialogue so that a legitimate passkey assertion was accepted in a context controlled by an adversary — a man-in-the-middle scenario that the FIDO2 standard was designed to prevent but that implementation choices in certain deployments left partially open.
What Defenders Should Do Now
Security practitioners should resist two tempting but wrong conclusions. The first wrong conclusion is that passkeys are broken and organisations should abandon them. They remain dramatically safer than passwords or traditional TOTP-based MFA against the vast majority of real-world phishing attacks. The second wrong conclusion is that passkeys can be deployed and forgotten. These findings reinforce that authentication security is an end-to-end problem: a cryptographically sound standard can still be undermined by OS-level token exposure, cloud sync architecture, or flawed relying-party implementation.
Practically, enterprises using passkeys should audit how authentication tokens are handled in memory and whether their platform’s sync infrastructure enforces device-bound attestation. For high-privilege accounts, hardware security keys that store private keys in tamper-resistant enclaves — and explicitly block cloud sync — remain the strongest available option.
A Broader Warning for the Authentication Ecosystem
The simultaneous appearance of three independent passkey attack vectors in a single week is unlikely to be coincidence. It reflects a maturing research focus: as passkeys move from pilot programmes into mainstream enterprise and consumer deployments, they become a target worth studying seriously. The FIDO Alliance and platform vendors will almost certainly respond with mitigations, and the attack techniques described are not trivial to exploit at scale. But the episode is a reminder that security standards are only as strong as their weakest implementation, and that declaring any authentication technology “phishing-resistant” in absolute terms invites the kind of scrutiny that researchers delivered last week. The industry would do well to treat “phishing-resistant” as a directional descriptor rather than a guarantee.
