3 ms·
What about passkeys? I think it's possible to sign into a passkey-supporting site with just the physical credential and its PIN.
by sowbug 2y ago
What about passkeys? I think it's possible to sign into a passkey-supporting site with just the physical credential and its PIN.
- lxgr 2y agoThat's less related to passkeys, and more to what the site (i.e. the Relying Party in WebAuthN parlance) requires in terms of authentication security. User Verification (including PINs) is possible for non-discoverable credentials and vice versa (e.g. Bitwarden's implementation doesn't seem to support user verification at authentication time, but supports discoverable credentials). In any case, note that this particular attack seems to degrade the security of "Yubikey + PIN" from two factors (possession of the key, knowledge of the PIN) to one (possession of the key), as the PIN entry can be bypassed due to how user verification works in WebAuthN/CTAP2.