Passkeys Pwned: Turning WebAuthn Against Itself
Shourya Pratap Singh, Jonny Lin, Daniel Seetoh
DEF CON 33 · Day 2 · Main Stage
Passkeys are widely positioned as the successor to passwords — phishing-resistant, cryptographically bound to origins, and immune to replay attacks. Google, Apple, Microsoft, and major enterprise plat
AI review
Square X maps the attack surface of passkeys at the browser mediation layer, demonstrating that WebAuthn's cryptographic guarantees dissolve when a malicious extension can override navigator.credentials API calls.