Passkeys: Better, Not Perfect

Passkeys: Better, Not Perfect

Why are passkeys described as better, but not perfect?

They improve authentication but can be undermined by weaker fallback methods and insecure synchronization.

What is an authentication downgrade attack?

Bypassing a stronger authentication option to attack a weaker one.

What weaker option can undermine a website's passkey protection?

A password-based login or recovery method.

Why do some websites retain password login after adding passkeys?

To provide a backup method if a user loses a passkey.

Can a site offering passkeys still be vulnerable to password attacks?

Yes, if password-based authentication remains available.

What is machine binding for a passkey?

Restricting the passkey to a particular device or system.

What deployment choice can weaken passkey security?

Allowing passkeys to synchronize between multiple devices without being machine-bound.

Why do some passkey providers allow synchronization?

To make passkeys easier to use across devices.

Which passkey storage products does the course mention as supporting synchronization?

Google Password Manager, Apple Keychain, 1Password, and Bitwarden.

How can synchronized passkeys become a phishing target?

Attackers may steal synchronization-account credentials and gain access to stored passkeys.

In the course phishing example, what type of site does the attacker create?

A lookalike login website with a misspelled domain.

What legitimate website is impersonated in the course example?

mail.falsimentis.com.

What lookalike domain is used in the course example?

mail.falismentis.com.

What login interface does the course's phishing example imitate?

A Bitwarden login prompt.

What information does the fake Bitwarden prompt request?

The user's email address and master password.

What can attackers attempt after collecting the password-manager login credentials?

Sign in to the password manager and synchronize stolen password and passkey data.

What conference does the course associate with the 'Your Passkey is Weak' demonstration?

DEF CON 33.

Which two password managers were examined in the course's cited passkey phishing proof of concept?

Bitwarden and Google Password Manager.

What two risks do passkeys help reduce?

Password guessing and exposure of authentication secrets after server breaches.

What limitation can prevent passkeys from delivering their full security benefit?

Leaving weaker legacy authentication methods enabled.

What does MFA stand for?

Multi-factor authentication.

According to the course, do passkeys eliminate the need for MFA?

No. The course recommends continued use of MFA solutions.

What should defenders review when evaluating passkey deployments?

Fallback authentication methods, machine binding, and synchronization security.