Strategies to secure passkeys against authentication vulnerability proposed

A recent blog post from eSentire discussed new strategies to secure passkeys and prevent authentication method redaction attacks, a technique used by cybercriminals to bypass security measures. These attacks involve manipulating the authentication process.

Authentication method redaction attacks involve bypassing primary authentication methods in favor of less-secure backup methods, which in turn enables Adversary-in-the-Middle (AitM) phishing attacks. eSentire demonstrates such an attack against Github, but says that numerous passkey implementations are similarly flawed.

The cybersecurity threat detection provider suggests that implementing multiple passkeys is a way to mitigate the threat of AitM attacks, so that losing one passkey neither blocks the user’s access nor requires a fallback to a less-secure authentication method. Magic links can also help, as a relatively secure fallback authentication method, but eSentire also introduces the concept of “warded links.”

Warded links are magic links that provide “a new secure authentication flow, isolated from any existing AitM-compromised session,” the post explains.

The company also recommends red-teaming authentication flow designs, ensuring that any move away from passkeys also initiates a new session, and using behavior analytics and a managed detection and response service to continuous protection and fast threat mitigation.

Analysts have identified potential man-in-the-middle (MITM) attacks targeting session cookies, which can be stolen post-authentication to impersonate users.

Despite the vulnerabilities, however, passkey adoption is growing rapidly.

Recently, Australia’s myGov app integrated passkeys, in a bid to provide a more secure authentication method for users. Mastercard announced its commitment to implementing passkeys and full tokenization for payments in the EU by 2030, and AWS added support for passkeys in June.

Article Topics

biometrics  |  cybersecurity  |  passkeys  |  passwordless authentication