Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls

Passkeys have established themselves as the standard for passwordless authentication, promising to eliminate phishing once and for all. But how secure are they really – and what do developers need to consider during implementation to keep that promise? This talk goes beyond the basics and demonstrates through live coding how to integrate Passkeys with Keycloak. We'll uncover common pitfalls and explain which configurations are critical to ensure true phishing resistance. Practical examples and concrete code demos will help you integrate Passkeys securely and user-friendly into your own applications.

Transcript

1. Passkeys Truly Phishing-Resistant? Implementation and Pitfalls Martina Kraus Kraus IT Consulting
2. Phishing?
3. T he P r ob l e m TOTP login — Adversary-in-the-Middle Victim Browser visits phishing URL AitM Proxy sh0p.com Legitimate Site shop.com 1. Victim enters username, password + TOTP on phishing page 2. Proxy forwards everything to the real site in real-time 033. Login succeeds — victim sees nothing unusual 4. Proxy steals the session cookie 5. Attacker uses the cookie — no password needed
4. (T)OTP does not protect against phishing.
5. How Passkeys Make Phishing Structurally Impossible
6. About me • Consultant / Trainer & Speaker • Application Security Engineer • OWASP member • W3C SWAG Community Group Member • Google Developer Expert Angular and Identity kraus.martina.m@gmail.com
7. • OAuth and OpenID Connect in Practice • Securing Modern Architectures with OAuth • Identifying and Fixing Vulnerabilities
8. How Passkeys Make Phishing Structurally Impossible
9. https://www.passkeys.io/technical-details#Behind-passkeys The "challenge" must be a buffer of random information at least 16 bytes in size. Creating a passkey
10. Creating a passkey https://www.passkeys.io/technical-details#Behind-passkeys
11. https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API Relying Party Public-Key- Cryptography ECDSA w/ SHA-256 (also known as NIST P-256) (-7)
12. https://www.passkeys.io/technical-details#Behind-passkeys Creating a passkey
13. https://www.passkeys.io/technical-details#Behind-passkeys Passkeys are bound to their rpId and cannot be used outside of it Creating a passkey
14. • RPId-binding: signature tied to domain • No shared secret: server stores only public key • Replay protection: challenge is one-time • No user secret can be intercepted Why phishing fails
15. Li ve Codi ng Integrating Passkeys with Keycloak 01 Realm Setup Configure Keycloak, enable Passkey policy 02 Relying Party ID Set rpId correctly — the most critical setting 03 Registration Register first Passkey, WebAuthn flow live 04 Authentication Passwordless login
16. Setting rpId Missing User Verification Ignoring Attestation Password Fallback Active The 4 Critical Pitfalls
17. 01 1. Setting rpId • rpId too narrow breaks your own flows and locks users out Set the RP ID as specific as you can, as broad as you must.— you can't migrate passkeys later 02 The 4 Critical Pitfalls • Use apex domain leaves you open for Subdomain Takeover attacks
18. 01 2. Missing User Verification Possession without presence Enforce userVerification: 'required' 02 The 4 Critical Pitfalls
19. 01 3. Ignoring Attestation No control over authenticator quality or type Validate attestation, define policy 02 The 4 Critical Pitfalls
20. Defines the attestation format used by the authenticator; if none, the device refused to attest.
21. Identifies the exact authenticator model; use it to look up device details in the FIDO MDS and enforce authenticator policies. (YubiKey 5 Series) 08987058-cadc-4b81-b6e1-30de50dcbe96 → Windows Hello fbefdf68-fe86-0246-8c24-1b1dd2caa9ab → Apple Touch ID
22. 01 4. Password Fallback Active Weakest link determines security level Fallback only for Account recovery 02 The 4 Critical Pitfalls
23. Passkey Integration Checklist ✓• Use apex domain from the start • Enforce userVerification ‘required’ • Validate attestation • Let password-based Authentication fade out
24. Passkey Integration Checklist ✓• Create a whitelist for AAGUIDs • Enforce device-bounded passkeys if necessary • Check cryptographic algorithms used for signatures • Do not implement this on your own
25. Q&A Thank you! kraus.martina.m@gmail.com