Community guidelines
Be specific and constructive. No vendor spam — promoting your own product belongs in a listing. Anyone can read; posting needs a free account.
We are rolling out passkeys and management thinks phishing is basically solved. Then Microsoft published that Storm-2372 writeup and recent attacks seem to use fake enrollment pages and device code flows instead of stealing the passkey itself. How are you explaining this without making the rollout sound pointless?
yeah, the passkey is still doing its job. The attacker is changing the flow. They trick the user into authorizing a new session or device instead of handing over a password. We tell users that no support person should send them a link to enroll a passkey or ask them to enter a device code they didn't initiate
We also alert on new authentication methods and unusual device registrations. Passkeys reduced normal credential phishing a lot, but the identity control plane became more important. Recovery is another weak point. If help desk can reset everything after one phone call, that is where the attacker goes.
Good point on recovery. Our current reset process is weaker than the sign in method. Did anyone put a delay on new passkey registration for privileged accounts?
We require an existing strong method plus manager approval for admin accounts, and we notify on every new credential. A delay can help, but it can also lock out a real admin during an incident. The useful control is a separate recovery path with good verification and logs