Page 245 - Cyber Defense eMagazine September 2025

4) Cloud Account Exploitation

To enable cross-device use, many ecosystems optionally sync passkeys via cloud. If an attacker takes
over that cloud account (weak recovery, SIM swap, social engineering), they may gain leverage over
synced authenticators.

Mitigate: require strong, phishing-resistant MFA on the user’s Apple/Google/Microsoft accounts; restrict
or opt out of cloud sync for high-risk roles; scrutinize account-recovery changes.

5) Phishable Backups & Recovery

The weakest link is often a “convenience” fallback—SMS codes, email links, or helpdesk resets used
when a user lacks their device. Attackers simply pivot to those flows, defeating the point of passkeys.

Mitigate: make every path (enrollment, recovery, device replacement, new-device sign-in) as phishing-
resistant as the primary. Require supervisor/ID proofing for resets, enforce out-of-band confirmations,
and disable SMS/email for privileged accounts.

6) Social Engineering & Coercion

No password doesn’t mean no people. Attackers still push users to approve prompts, scan rogue QR
codes, or enroll attacker-owned keys. In some cases, they add their own authenticator post-compromise
to maintain persistence.

Mitigate: user education; approval fatigue protections; out-of-band verification for new authenticator
enrollment; and alerts on enrollment events—especially for admins.

Passwordless vs. Phishing-Resistant: Know the Difference

• Passwordless = no memorized password (could be biometrics, magic links, OTPs, passkeys).

• Phishing-resistant = the method does not expose a reusable secret and won’t authenticate the
wrong origin (e.g., FIDO2/WebAuthn passkeys, smart cards, certificate-based auth).

Some passwordless methods (SMS, email links, OTPs) are not phishing-resistant. They may be useful
transitional tools, but they’re not end-state security. Aim for passkeys where feasible, and ensure all
auxiliary flows meet the same bar.

Field Lessons (What Real Programs Learn)

• Biometrics need hardening and patch discipline. Research keeps finding edge cases;
vendors patch; you must stay current.

• Cross-device flows can be abused if users aren’t trained to recognize legitimate prompts/QRs.
Proximity checks and trusted out-of-band confirmations help.

Cyber Defense eMagazine – September 2025 Edition 245
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.