How Attackers Bypass Synced Passkeys

The Hacker News explains that synced passkeys carry the same risks as the cloud accounts and recovery processes that protect them, creating material enterprise exposure. It highlights three operational risk areas: cloud account takeover or recovery abuse, when passkeys could be synced to personal accounts, and help desk or recovery processes becoming attack points for attackers.

The piece cites Proofpoint researchers describing a practical downgrade against Microsoft Entra ID where a phishing proxy spooks an unsupported browser, allowing weaker authentication methods to be used and credentials and session cookies to be captured. It also notes that compromised browser extensions can hijack WebAuthn calls, manipulating registration or sign-in and potentially driving autofill to exfiltrate data, with Chrome's webAuthenticationProxy extension API enabling interception of credential requests.

The article argues that device-bound passkeys stored in hardware offer higher enterprise assurance and should be mandatory, while warning that universal coverage is necessary because you are only as protected as your weakest link. For enterprise guidance, it promotes policies that eliminate fallbacks, enforce phishing-resistant, device-bound credentials, and ensure real-time device posture in ongoing authentication.