Oct 15, 2025Ravie LakshmananData Safety / Browser Safety
TLDR
Even if you happen to take nothing else away from this piece, in case your group is evaluating passkey deployments, it’s insecure to deploy synced passkeys.
Synced passkeys inherit the chance of the cloud accounts and restoration processes that defend them, which creates materials enterprise publicity.
Adversary-in-the-middle (AiTM) kits can drive authentication fallbacks that circumvent robust authentication all collectively
Malicious or compromised browser extensions can hijack WebAuthn requests, manipulate passkey registration or sign-in, and drive autofill to leak credentials and one-time codes.
Machine-bound passkeys in {hardware} safety keys provide larger assurance and higher administrative management than synced passkeys, and must be obligatory for enterprise entry use instances
Synced Passkey Dangers
Synced passkey vulnerabilities
Passkeys are credentials saved in an authenticator. Some are device-bound, others are synced throughout units via client cloud providers like iCloud and Google Cloud. Sync improves usability and restoration in low-security, consumer-facing situations, however shifts the belief boundary to cloud accounts and restoration workflows. The FIDO Alliance and Yubico, have each issued essential advisories for enterprises to guage this cut up and to want device-bound choices for larger assurance.
Operationally, synced passkeys increase the assault floor in 3 ways:
Cloud account takeover or restoration abuse can authorize new units, which then erodes the integrity of the credential.
If a consumer is logged in on their company machine with their private Apple iCloud account, then passkeys created may very well be synced to their private accounts; this dramatically explodes the assault floor past enterprise safety boundaries.
Assist desk and account restoration turn into the true management factors that attackers goal as a result of they’ll copy the identical protected keychain onto a brand new, unknown, and untrusted machine.
Authentication downgrade assaults
See the “captured” session. (Picture supply: Proofpoint)
Proofpoint researchers documented a sensible downgrade in opposition to Microsoft Entra ID the place a phishing proxy spoofs an unsupported browser, corresponding to Safari on Home windows, Entra disables passkeys, and the consumer is guided to pick a weaker technique, corresponding to SMS or OTP. The proxy then captures credentials and the ensuing session cookie and imports it to realize entry.
This risk vector is reliant on webAuthnpasskey’s uneven working system and browser help and the identification supplier’s (IdP) acceptance of weak authentication strategies in favor of a sensible UX consideration. It’s a traditional adversary-in-the-middle (AitM) powered by coverage steering. It doesn’t break WebAuthn origin binding as a result of the platform by no means reaches a WebAuthn ceremony when a compatibility department disables it. Your weakest authentication technique defines your actual safety.
Rapid mediation in WebAuthn is a function that enables websites to supply an alternate authentication technique when WebAuthn just isn’t accessible. That is helpful for UX however will also be abused by attackers to steer customers towards non-webAuthn paths if coverage permits them.
Browser-based safety susceptible to extension and autofill risk vectors
SquareX researchers confirmed {that a} compromised browser setting can hijack WebAuthn calls and manipulate passkey registration or sign-in. The method doesn’t break passkey cryptography. It injects or intercepts the browser-side course of, for instance, via a malicious extension or an XSS bug, to reinitiate registration, drive a password fallback, or silently full an assertion.
Chrome paperwork an extension API named “webAuthenticationProxy” that may intercept navigator.credentials.create() and navigator.credentials.get() strategies as soon as connected, then provide its personal responses. This functionality exists for distant desktop use instances, nevertheless it demonstrates that an extension with the proper permission can sit within the WebAuthn path.
Extensions additionally run content material scripts contained in the web page context, the place they’ll learn and modify the DOM and drive consumer interface flows, which embody invoking credential APIs from the web page.
Impartial analysis introduced at DEF CON described DOM-based extension clickjacking that targets the UI components injected by password supervisor extensions. A single consumer click on on a crafted web page can set off autofill and exfiltration of saved information corresponding to logins, bank cards, and one-time codes. The researcher studies that in some situations, passkey authentication will also be exploited and lists susceptible variations throughout a number of distributors.
Machine-bound credentials are the one efficient enterprise resolution
Machine-bound passkeys are tied to a particular machine, usually with non-public key era and utilization carried out in safe {hardware} elements. In enterprise, {hardware} safety keys present constant machine alerts, attestation, and a lifecycle you possibly can stock and revoke.
Steering for an enterprise-grade passkey program
Coverage
Require phishing-resistant authentication for all customers, and particularly these in privileged roles. Settle for solely device-bound authenticators that generate non-exportable credentials at registration and by no means depart the machine. Credentials must be rooted in safe {hardware} and verifiably tied to the bodily machine making an attempt the login.
Eradicate all fallback strategies corresponding to SMS, voice calls, TOTP apps, e-mail hyperlinks, and push approvals. These exist to be exploited throughout social engineering and downgrade assaults. If a fallback exists, an attacker will drive it. Make the robust path the one path.
Guarantee common working system and browser help for phishing-resistant, device-bound credentials. Do not provide alternate options – sure that is potential, we’re glad to point out you a demo with Past Identification’s identification protection platform. Common protection is important for full protection since you’re solely as protected as your weakest hyperlink.
Browser and Extension Posture
Implement extension allowlists in managed browsers. Disallow any extension that requests webAuthenticationProxy, activeTab, or broad content material script permissions.
Constantly monitor extension installs and utilization developments for suspicious mass removals or unexplained permission escalations. Extension-level compromise is more and more indistinguishable from a reputable consumer. Lock down browser conduct as tightly as you’d an endpoint.
Enrollment and Restoration
Use high-assurance authenticators as the foundation of restoration. No assist desk, e-mail inbox, or name middle ought to have the ability to bypass phishing-resistant controls. Restoration is commonly the attacker’s entry level. Eradicate social engineering vectors and drive policy-compliant reproofing.
Solely enable for enrollment of device-bound credentials.
Seize attestation metadata at registration, together with machine mannequin and assurance degree. Reject unrecognized or unverifiable authenticators. Belief begins at registration. If you do not know what created the credential, you do not management entry.
Machine Hygiene & Runtime Protection
Bind classes to trusted machine context. A session cookie ought to by no means be a conveyable artifact. Runtime session enforcement ought to tie identification to steady machine posture, not simply an preliminary authentication.
Implement steady authentication. If machine posture, location, or safety standing modifications, require reauthentication or deny entry. A login just isn’t a corridor go. Threat is dynamic, authentication should be too.
Assume authentication makes an attempt with weak components must be blocked by default. See how Past Identification prospects immediately block identification assaults based mostly on the straightforward undeniable fact that it isn’t a robust credential making an attempt entry.
What This Appears Like in Follow
The structure of an identification safety system that provides uncompromising protection in opposition to identification, browser, and device-based assaults may be outlined by these three traits:
Machine-bound credentials: Credentials by no means depart the machine. They’re non-exportable, hardware-backed, and can’t be synced or replayed elsewhere.
Steady belief: Authentication by no means stops at login. It continues all through the session, tied to posture alerts from the machine.
Common endpoint hygiene enforcement: All endpoints are in scope. Even unmanaged units should be evaluated in actual time for danger posture and session integrity.
The underside line
Synced passkeys are usually not a drive discipline that’s applicable for protection. They enhance usability for client use instances at the price of enterprise entry safety.
See extra in-action in an upcoming webinar, How Attackers Bypass FIDO: Why Synced Passkeys Fail and What To Do As an alternative the place Past Identification will evaluation how synced passkey failures occur and the way main safety groups, together with Snowflake and Cornell College, shut these paths.
Even if you cannot be a part of, register and you will get the recording!
