
Replays, Master Keys, and Silent Prompts: Unpacking the Hidden Infrastructural Flaws Behind FIDO2
I've spent the last few years telling friends and family the same thing: switch to passkeys, they can't be phished. That advice wasn't wrong exactly, but reading through this new research left me a little humbled. Three separate teams just showed that you don't need to break FIDO2's cryptography to beat it. You just need to find the messy human infrastructur…




