3 ms·

since not stated in the article and I started to get worried, this was reported last year. Safari: fixed in 18.3 (Jan 2025) Firefox: fixed in 136 (March 2025)

since not stated in the article and I started to get worried, this was reported last year. Safari: fixed in 18.3 (Jan 2025) Firefox: fixed in 136 (March 2025) Chrome: fixed in 130.0.6723.58/.59 (Oct 2024) Wow - only Google seemed to really prioritize fixing this / had the processes and manpower to get a fix out quickly. Mozilla’s bug report is still locked down but Google’s is open: https://issues.chromium.org/issues/370482421 https://issues.chromium.org/issues/370482421

protimewaster 2y ago
> Wow - only Google seemed to really prioritize fixing this / had the processes and manpower to get a fix out quickly. I would have guessed they'd be the quickest, but I wouldn't have guessed they'd be months ahead of the others.
- jbverschoor 2y ago
  Perhaps they had the info before it was disclosed to the others?
  - crtasm 2y ago
    https://www.mozilla.org/en-US/security/advisories/mfsa2025-14/#CVE-2024-9956 https://www.mozilla.org/en-US/security/advisories/mfsa2025-1... links the bug https://bugzilla.mozilla.org/show_bug.cgi?id=1922357 https://bugzilla.mozilla.org/show_bug.cgi?id=1922357 but it's not public, perhaps someone can tell us when it was opened.
    - jbverschoor 2y ago
      The next issue, https://bugzilla.mozilla.org/show_bug.cgi?id=1922358 https://bugzilla.mozilla.org/show_bug.cgi?id=1922358 is from October 2nd 2024
- gavinsyancey 2y ago
  Reading through the Chromium bug report, it looks like the reporter wasn't able to get in contact with Mozilla until February, so after they were aware it only took a month to fix the bug in Firefox. It's unclear when they started trying, and who's fault the delay is.
- mastersplinter 2y ago
  I can't speak to the prioritization differences between the different browser teams, Chrome was definitely the best which isn't surprising considering their resources. Apple was also quite swift but I imagine it took them some time to decide where to deliver the fix, I myself wasn't sure if this is something that should be blocked at the OS level (the Authentication checking the intent origin) or browser. Mozilla is usually the slowest out of the three but they were still very professional.
bflesch 2y ago
The involved engineers are most likely running around with a blushed-red face to this day, claiming "phishing resistance" in all the marketing materials but then having such a bug. I'd say the cover-your-ass (CYA) reflex was a big incentive for google engineers to fix it quickly.
- lxgr 2y ago
  Phishing resistance isn't a binary property, it's a spectrum, and even with this vulnerability, that of passkeys is orders of magnitude higher than that of most other alternatives (including passwords, SMS OTP, TOTP etc.)
- acdha 2y ago
  This attack requires physical presence and visiting an attacker-controlled page. It’s absolutely a real threat and great work, but there are multiple orders of magnitude more people getting phished using weak MFA than by an attacker with control of a BLE device in their home or office.
verst 2y ago
Microsoft Edge had a release based on the relevant Chromium version on Oct 17, 2024. That is release 130.0.2849.46: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnote-stable-channel#version-1300284946-october-17-2024 https://learn.microsoft.com/en-us/deployedge/microsoft-edge-... https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-9956 https://msrc.microsoft.com/update-guide/en-US/vulnerability/...

protimewaster 2y ago

> Wow - only Google seemed to really prioritize fixing this / had the processes and manpower to get a fix out quickly. I would have guessed they'd be the quickest, but I wouldn't have guessed they'd be months ahead of the others.

jbverschoor 2y ago
Perhaps they had the info before it was disclosed to the others?
- crtasm 2y ago
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-14/#CVE-2024-9956 https://www.mozilla.org/en-US/security/advisories/mfsa2025-1... links the bug https://bugzilla.mozilla.org/show_bug.cgi?id=1922357 https://bugzilla.mozilla.org/show_bug.cgi?id=1922357 but it's not public, perhaps someone can tell us when it was opened.
  - jbverschoor 2y ago
    The next issue, https://bugzilla.mozilla.org/show_bug.cgi?id=1922358 https://bugzilla.mozilla.org/show_bug.cgi?id=1922358 is from October 2nd 2024
gavinsyancey 2y ago
Reading through the Chromium bug report, it looks like the reporter wasn't able to get in contact with Mozilla until February, so after they were aware it only took a month to fix the bug in Firefox. It's unclear when they started trying, and who's fault the delay is.
mastersplinter 2y ago
I can't speak to the prioritization differences between the different browser teams, Chrome was definitely the best which isn't surprising considering their resources. Apple was also quite swift but I imagine it took them some time to decide where to deliver the fix, I myself wasn't sure if this is something that should be blocked at the OS level (the Authentication checking the intent origin) or browser. Mozilla is usually the slowest out of the three but they were still very professional.

bflesch 2y ago

The involved engineers are most likely running around with a blushed-red face to this day, claiming "phishing resistance" in all the marketing materials but then having such a bug. I'd say the cover-your-ass (CYA) reflex was a big incentive for google engineers to fix it quickly.

lxgr 2y ago
Phishing resistance isn't a binary property, it's a spectrum, and even with this vulnerability, that of passkeys is orders of magnitude higher than that of most other alternatives (including passwords, SMS OTP, TOTP etc.)
acdha 2y ago
This attack requires physical presence and visiting an attacker-controlled page. It’s absolutely a real threat and great work, but there are multiple orders of magnitude more people getting phished using weak MFA than by an attacker with control of a BLE device in their home or office.

verst 2y ago

Microsoft Edge had a release based on the relevant Chromium version on Oct 17, 2024. That is release 130.0.2849.46: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnote-stable-channel#version-1300284946-october-17-2024 https://learn.microsoft.com/en-us/deployedge/microsoft-edge-... https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-9956 https://msrc.microsoft.com/update-guide/en-US/vulnerability/...