An article about phishing kits that use browser-in-the-browser techniques and attempt to register rogue passkeys got me thinking about our defenses. We pushed for restricting access to managed devices, but that was rejected. Due to repeated delays and interference, we are only now rolling out passkeys and preparing to block app-based MFA, while the other major controls are already in place. If we move to passkey-only authentication, would that prevent this type of attack, or can attackers use an adversary-in-the-middle setup against passkeys in the same way they target app-based MFA?
2 Answers
A properly implemented passkey is resistant to the usual adversary-in-the-middle and fake-login-page attacks because it is bound to the legitimate website origin. Make sure the rollout requires passkeys for sign-in, includes user verification where appropriate, and does not leave weaker fallback methods available.
If passkeys are the only authentication method, they should prevent the initial phishing-based compromise and stop the attacker from getting far enough to register another passkey. The important distinction is moving to passkey-only authentication rather than merely offering passkeys alongside passwords or app-based MFA.
That clarifies the part I was unsure about. I was wondering whether this browser-in-the-browser approach could intercept passkeys just as attackers are currently abusing app-based MFA, but it sounds like origin binding is what prevents that during normal authentication.