Passkeys are showing up everywhere, but how many people can actually say how they work, where they break, or how to test one?
We'll start with a Passkey 101: what FIDO2, WebAuthn and CTAP actually are, and what people mean by "un-phishable."
With that established, the protocol turns out to be the easy part. The security you get depends on the deployment and we will demonstrate it with four attacks. An XSS bug can be enough to plant an attacker's passkey on a victim's account, and inelegant signature-counter implementation for roaming credentials can allow credential replay. A simple but surprising IDOR in WebAuthn payloads can bypass poorly-implemented FIDO2 auth, and in SimpleWebAuthn we found and reported a certificate-chain validation flaw in attestation that let a forged authenticator pass as genuine.
We will also release two new tools for inspecting and tampering with passkeys, so you can find these issues in your own targets. By the end you'll know where passkey deployments break, and you'll have the tools to prove it.