Debate over whether passkey attestation could lock out users
Critics say sites could later reject non-attested passkeys; Apple and FIDO participants say consumer attestation is not the goal.
Stories per day · 30 days
9 stories, newest first · one card per story
Stories tagged #webauthn
Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Huntress says the EvilTokens device-code phishing kit hit 344 organizations without breaking passkey cryptography.
Product showcase: SimpleLogin keeps your email address private with aliases
Proton's SimpleLogin forwards mail through aliases so users can hide a primary email address.
3
I don't like passkeys
A security blogger argues passkeys suit enterprises but expose individuals to lockout, ban, and recovery risks that outweigh their phishing protection.
2
Stop Telling People Not To Click Links
Tailscale CEO argues link-clicking is not the problem; deploying phishing-resistant authentication like passkeys and WebAuthn eliminates entire attack classes.
1
iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset
Abnormal Security details iAuthFlow v2, a $10,000 phishing kit that enrolls attacker-controlled passkeys on Google accounts, persisting through password resets.
ChatGPT advanced account security adds passkeys and hardware keys
OpenAI launches Advanced Account Security for ChatGPT and Codex, replacing passwords with passkeys or hardware keys and disabling email/SMS recovery.
10
Google Password Manager Attacks Could Let Malware Hijack Passkey
Unit 42 details three attack paths letting Windows malware silently sign into passkey-protected accounts via Chrome's Google Password Manager without user verification.
1
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing
Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.
4