SquareX Researchers Demonstrate Passkey Login Vulnerability via WebAuthn Manipulation

What's Happening?

Researchers at SquareX have identified a method to bypass passkey login security through manipulation of the WebAuthn process. Passkeys, which are increasingly adopted by major tech companies like Microsoft, Amazon, and Google, are designed to offer a secure alternative to passwords by using a private key stored on the device. The attack does not compromise passkey cryptography but exploits vulnerabilities in the browser environment, allowing attackers to impersonate users and bypass security measures even when using Face ID. The attack involves hijacking the WebAuthn API through JavaScript injection, requiring the user to install a malicious browser extension or exploit a client-side vulnerability such as an XSS bug.

Why It's Important?

The discovery of this vulnerability highlights potential security risks associated with passkey authentication, which is considered phishing-resistant. As passkeys are increasingly adopted by tech giants, ensuring their security is crucial for protecting user data and maintaining trust in digital authentication methods. The ability to bypass passkey security could have significant implications for cybersecurity, potentially affecting millions of users who rely on passkeys for secure access to their accounts. This development underscores the need for continuous monitoring and improvement of security protocols to safeguard against emerging threats.

What's Next?

The cybersecurity community may need to reassess the security measures surrounding passkey authentication and WebAuthn processes. Companies using passkeys might implement additional security layers or update their systems to prevent such vulnerabilities. Users are advised to be cautious about installing browser extensions and to ensure their devices are protected against client-side vulnerabilities. Further research and collaboration among tech companies could lead to enhanced security standards and practices to mitigate risks associated with passkey authentication.