Czy passkeys nadal są bezpieczne?

Scientific concepts / technical discoveries / nature phenomena mentioned

• Passkeys (WebAuthn / related standards) as a replacement for passwords using public-key cryptography:

  • Identity proof via challenge–response:
    • The service sends a unique random challenge.
    • The user signs it with a private key.
    • The service verifies the signature using the public key.
  • Claimed security properties:
    • Reduced credential reuse
    • Unique keys
    • Replay/phishing resistance as intended goals

• Replay attacks (core threat concept):

  • Capturing prior authentication data and reusing it to impersonate the user.
  • Security depends on correct server-side invalidation of challenges and on preventing attackers from reusing captured responses.

• Side-channel / operational risk from logging:

  • The video claims that on Windows 11, passkey flows involve the Windows system library / API, and that system logs can record:
    • the server-provided challenge
    • the response signed by the user
  • If attackers can access or influence these logs (commonly via malware), they can enable authentication takeover.

• Windows Hello / device-mediated cryptography:

  • Passkey authentication via Windows Hello, including hardware protections such as TPM or a physical key (referenced as “Ubikia”).
  • Phone-based keys may use Bluetooth Low Energy.
  • The analysis emphasizes that although hardware protects the private key, the OS API implementation/usage can still allow abuse.

• Specific implementation flaws in Microsoft services (Entra ID / “Entra ID”):

  • The video claims Microsoft implemented challenge expiry and reuse incorrectly, allowing challenge replay due to insufficient enforcement of “one-time” usage.
  • It describes how this can interact with logging/capture techniques to enable “login as another user.”
  • The discussion includes how these replay/automation patterns may undermine MFA and “phishing-resistant MFA.”

• Other attack patterns enabled by Windows passkey APIs (all assuming malware/remote control on the victim in various scenarios):

  • Racing the user to submit captured signed challenges first
  • Prompt spam / repeated authentication windows to trick users
  • Multiple prompt overlay/session tricks, presenting malicious prompts around legitimate ones
  • Authentication name/app identity spoofing via values embedded in executables, affecting user trust
  • Authentication attempts triggered during Remote Desktop / pass-through scenarios
  • “Enterprise deployment” implications:
    • impersonating admin actions
    • registering additional credentials
    • persistence even after password changes
    • potential theft of credentials from a local password manager (not TPM)

Security tooling / methodology (a test toolkit)

The researchers provide multiple tools to reproduce and evaluate weaknesses in passkey implementations:

• Passkey Injector: a browser-based tool built on Microsoft Edge control to intercept/modify web authentication login queries (via JSON injection)
• Sharp Passkeys: displays an authentication window, intercepts the signed challenge, and forwards it to an attacker
• DS Internals Passkeys UI: visualizes and exposes many passkey API functions and behaviors
• Additional mentioned components:
  • hooks
  • PowerShell scripts
  • a public/open-source toolkit with one exception (a “beacon” kept out)

Patch status and remediation concepts

The video claims:

• Microsoft patched the most serious issue by stopping full challenge/response storage in logs and storing only hashes for diagnostics.
• A replay-attack patch applies only to some cases; Windows Hello may remain vulnerable.
• A third “passkey window bug” allegedly was not fixed.

Practical security guidance (countermeasures proposed)

• Prefer passkeys, but ensure hardware-backed storage (TPM / hardware keys) rather than storing private material in easily stolen locations.
• Test deployments for missing patches and incorrect configuration.
• Use proven libraries and avoid implementing complex authentication logic from scratch.
• Don’t log secrets or authentication materials.

Researchers / sources featured (as named in the subtitles)

• Michael Grafneter (and his Specter Ops team)
• Microsoft (as the implementing/patching party and co-creator of the WebAuthn standard)
• DS Internals
• GitHub
• Rockstar Studio (mentioned in relation to an MFA fatigue-like incident)
• Open AI (mentioned earlier in the video’s context; not central to the passkey findings)
• Hugging Face (mentioned earlier in the video’s context; not central to the passkey findings)