Anvil Secure has published a passkey security-testing whitepaper with a 43-case reference for assessing deployed authentication systems, covering the components around a passkey sign-in as well as the underlying protocols.
The 60-page paper, Demystifying Passkeys: Under Attack, was written by security engineer Matteo Giordano. It is the third part of a series that previously examined passkey protocols and architecture, and is aimed at security engineers and penetration testers reviewing implementations.
Passkeys replace reusable passwords with public-key credentials. Anvil describes them as a substantial improvement against credential stuffing and conventional credential phishing, while directing testers to examine enrollment, client behavior, server validation, synchronization and account recovery.
The framework groups the attack surface into six areas: authenticators and protocols; cross-device transport; clients such as browsers and password managers; the relying party, meaning the service that accepts a sign-in; credential synchronization; and users and recovery processes. Each area has different controls and assumptions to assess.
The test reference includes checks for signature validation, permitted origins, the identifier of the accepting service, and whether an authentication challenge is tied to the correct session. It also addresses credential-management permissions and recovery routes that can provide an alternative path into an account.
The paper surveys available testing tools, including Anvil’s existing Passkey Editor extension for Burp Suite. That tool lets researchers decode, modify and re-sign WebAuthn traffic while testing controlled deployments. WebAuthn is the web authentication standard used to exchange credential-registration and sign-in information.
Implementation risks have featured in separate research, including Unit 42’s attack paths against Google Password Manager on Windows. Those scenarios involved access to the local user environment and surrounding storage or validation behavior, rather than breaking public-key cryptography.
Researchers have also examined passkey validation traffic that bypasses Apple’s Private Relay, a privacy issue involving origin-validation requests outside Safari’s protected browsing path. Both client behavior and the service’s validation rules are included in the whitepaper’s test reference.
The test cases include safety flags for operations that change state, risk locking out an account or require cleanup. Several specify disposable test credentials or environments, keeping the assessment tied to an authorized scope and the deployment’s intended security policy.
Sources: Anvil Secure
–
By the ID Tech Editorial Team
