Are passkeys as secure as you think?

The talk starts by explaining what passkeys are: FIDO2 WebAuthn discoverable credentials that replace shared secrets with a private key held in a secure element. Sign-in is unlocked by a PIN or biometric, and origin binding ties each credential to its website, which is why passkeys resist phishing. The speaker separates synced passkeys, backed up by platform or third-party vendors, from device-bound keys such as hardware security keys, and notes that the cloud-synced option makes recovery easy but moves trust to the vendor.

The middle section covers attestation and the attacks against the chain. Authenticator model identifiers (AAGUIDs) can be spoofed by modifying open-source software, and attestation is only checked at registration and is not offered for synced passkeys. Downgrade to weaker fallback methods, malicious browser extensions and token theft were shown as practical routes around the protocol. Weak PIN policies on security keys, a published side-channel attack on a hardware key chip that exposed attestation material on older firmware, and a Bluetooth proximity relay against cross-device QR sign-in were presented as more specific risks. Synced third-party password managers were shown storing private keys in plaintext export form and, in the services tested, without MFA on the vault.

The closing part lists mitigations. In Entra, conditional access and authentication strengths can enforce passkey-only sign-in and restrict fallback access, and admins can be required to use device-bound keys with attestation enforced and AAGUIDs allowed or blocked. For users, Apple Advanced Data Protection and Google Advanced Protection reduce exposure, and two registered security keys are recommended. The takeaway is that passkeys still beat passwords with TOTP, and the initial sign-in is resistant to phishing, but synced keys and cross-device flows deserve a deliberate threat model.