7mo ago

Passkey Redaction Attacks Subvert GitHub, Microsoft Authentication

www.darkreading.com Passkey Redaction Attacks Subvert GitHub, Microsoft Authentication

Adversary-in-the-middle attacks can strip out the passkey option from login pages that users see, leaving targets with only authentication choices that force them to give up credentials.

Adversary-in-the-middle attacks can strip out the passkey option from login pages that users see, leaving targets with only authentication choices that force them to give up credentials.

You're viewing a single thread.

19 comments

Wait, haven’t some sources been touting how ultra-secure and unbreakable passkeys are? And now we find that they’re susceptible to comparatively simple MITM attacks?
- This is just someone siting in the middle and modifying a page not to show the passkey login option anymore and then stealing a password/session token.
  As far as I can tell, this has almost nothing to do with passkeys specifically and would only apply in a situation where a website has a username and password fallback in case a passkey isn't created or isnt working.
  
  I haven't started using passkeys yet because I haven't looked into them. Sell me on them?
  
  I'm not an expert, so this is an oversimplification, but:
  Passkeys are essentially like authenticating the same way you do via SSH, but with websites. The site will use a public key for your account. Your passkey holds the private key. That's it, as I understand it.
  The advantages are that your accounts secured by passkeys will be inherently more difficult to crack than even the most complex, random passwords and it can't be phished (if you're using a physical passkey).
  The disadvantage is that the standard is still being worked on, and bad actors (MS, Apple, Google, etc.) are eager and willing to sucker people in to using their vendor lock-in software implementations of them. If you want to avoid this, either use real, physical FIDO-capable hardware authentication keys, or use a FOSS password manager that is capable of emulating them.
  
  You also get additional protection because rather than each website holding onto a hashed (hopefully) copy of the user passwords that can be stolen in bulk, stealing the public keys for a passkey from a site wouldn't compromise the account. Someone would have to get access to your physical device or hack your password manager individually to get access to your passkey.
  And and, the magic for most people is no more passwords and 2 factor stuff to deal with. The standard is still new, and in the cases where you want to use physical keys, its always best to keep 2 in case one gets smushed or goes through the washer. Some sites that have passkeys enabled only let you have 1 passkey. So in that case its kind of risky to make a passkey the only way to sign in.
  
  Okay, so it's just like Yubikey-type stuff? I've thought about that before but it seems very risky - they recommend you get two and set both of them up so you have a backup, but that would require all websites to support that, right?
  I'm down for using BitWarden, though, if I can substitute it for physical keys.
  
  Okay, so it's just like Yubikey-type stuff? I've thought about that before but it seems very risky - they recommend you get two and set both of them up so you have a backup, but that would require all websites to support that, right?
  Pretty much. I suppose that's a very real disadvantage to using physical passkeys. If you lose it, unless you have multiple passkeys configured, or have access to an account recovery method, you lose that account.
  But, like you mentioned, using Bitwarden would sidestep that issue, and they do support passkey emulation.
  
  I haven’t either because I don’t see the advantage. Cases like this show that there may not be any.
  
  Cases like this only prove that a better lock doesn't improve security when the old lock still lets you in.
  The takeaway here isn't "passkeys are bad", it's "keeping less secure methods of authentication as a fallback is bad"
  It's like saying all 2FA is bad because SMS 2FA is dogshit.
  
  This is the real takeaway, if you have a forgot password button that bypasses everything then none of it is anything more than a login accelerator.
  
  If The Next Big Thing can be sidelined by simply blocking its login option, that’s a problem. Not only is it not secure, it’s not even reliably usable.
  
  This isn't inherent to passkeys or the standard that they use. This has to do with the configuration of the service being attacked and the fact that once you've achieved MiTM, the sky is the limit for what you can do.
  Passkeys use the same underlying protocol as hardware authentication keys (FIDO, not the YubiKey auth protocol) and should be roughly as secure and vulnerable as that type of MFA method.
  
  This is more like triple bolting the door but leaving a window open. There's nothing inherently wrong with the door, its still secure but you can bypass the secure option with a less secure method.
  
  Arguably, it’s more like someone is able to hide the door altogether and force you to climb through the less-well-secured window. The fact that they can hide the door at all makes its locks meaningless.
  I get that this is an inherent problem of security mechanisms in general and not of passkeys in particular. But it still reduces passkeys to just fancy passwords. They’re obviously not any more reliable in practice.
- Passkeys are so secure that it's easier just to hack the page and not offer them as a login option, but that's your takeaway and you got multiple upvotes? God help us.

19 comments