Hacker News Reader

Comment by aleksejs | Hacker News Reader

> re-enroll attacker's key or register attacker's passkey

Can you walk me through how that would work?

Probably something like this https://cybersecuritynews.com/hackers-abuse-microsoft-entra-...

The article describes a straightforward phishing attack that works specifically against accounts that are _not_ protected by passkeys:

> Depending on which multi factor method the account uses, the victim sees a matching fake screen, whether a one time code prompt, an authenticator app number match, or an SMS page.

The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails. When a phishing campaign with the subject line "Your Mailbox is Full, Log In to Fix Now!" succeeds, that does not demonstrate an interesting vulnerability inherent to your mail server's mailbox size limits.

> The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails.

That's wrong. They attackers actually go on to create a real passkey that gives their device access to the compromised account.

Accounts that are already protected by passkeys can still be vulnerable too. see:

https://www.forbes.com/sites/zakdoffman/2025/08/28/yes-your-...

https://www.esentire.com/blog/securing-passkeys-thwarting-au...

https://unit42.paloaltonetworks.com/passwordless-authenticat...

Right, if you phish the credentials to an account that is not protected by a passkey, one thing you can now do is set up your own passkey on it. That's exactly what passkeys would've protected the victim against!

The other articles you've linked also describe attacks against accounts that allow non-passkey logins, or attacks that require a compromised browser.

There will never be a login that doesn't involve a potentially compromised device/OS/browser/password manager. As long as using a passkey means using those things too, having a passkey isn't enough to keep attackers out of your accounts. They can be pretty good about keeping legitimate users out of their accounts though. You just have to weigh that risk against the risk of you falling for a phishing attack.

Security is never perfect, if your device is already compromised, you have bigger issues. None of the traditional methods would protect against compromised devices anyway.

The point is that passkeys significantly reduce the attack surface.

In this attack, it sounds like the key step was that the user entered their username and password, thinking they were preparing to enter a passkey. It wasn't the passkey system itself (which would prevent this attack), it was the transition from password → passkey system that was attacked.

In any case, if you can get the user on the phone and convince them to let you walk them through a bespoke auth flow, I doubt there is any auth mechanism that would stop this. This is why every auth system these days is constantly telling you "We'll never ask for X", because at that point, the game is over.

> In any case, if you can get the user on the phone and convince them to let you walk them through a bespoke auth flow, I doubt there is any auth mechanism that would stop this.

Exactly. Passkeys can't solve the problem of phishing. At best it only makes it more difficult. Phishing is less of a concern to me personally than losing my access to my account because of the complexity and fragility of passkeys. I've read enough horror stories, even from very capable people, about people who were screwed because they thought they were doing the right thing by setting up passkeys. Passkeys sound like they might be great for many other people. My vulnerability to phishing doesn't justify the risk of passkeys.

Can you not just use the reset password flow any website has?

Isn’t that a bug in the Microsoft software, not the pass key specification?

That's like saying that there's nothing wrong with passwords, it's a bug in the human that can't tell the difference between their bank's website and some random web form with their banks logo slapped on it created on wix.com

Attacks on passkeys have been because of flaws in the OS, or the browser, or the password manager, but none of those things are going away any time soon. Passkeys depend on those things, which means they aren't are solution to the problem of phishing. They just make phishing harder.

Passkeys also make things harder for the legitimate user though, and there's a very real question of whether the protection they offer is worth the trouble.

But every single one of those attacks has also existed for classic password managers.

It’s not a new vulnerability. It’s not a reason to roll out Passkeys unless it’s also a reason to get rid of passwords.

With Passkeys you’re still net ahead.

Reply on news.ycombinator.com