mastersplinter

Hi there! Recently released the video of a talk about a new technique for stealthy NTLM relaying in a hardened Active Directory environment. Let me know what you think!

will think about this and try to find a good subtitle, thanks :)

I like “phishing passkey protected accounts”.

I'm not sure I understand what you mean here with: > I’m not going to reach for my phone to scan the QR

The whole point of the attack is that it can be delivered without you having to scan the QR code, exploiting the fact that browsers allowed (patched) navigation to fido:/ links, initiating the BLE communication to a malicious device that is relaying the communication to the legitimate site, stealing a session. Let me know if that clears up the confusion.

As for phishing resistant/ phishing proof, to some is the same thing, nothing is "anything"-proof so I did not pay too much attention to the wording. Also I just wanted to stress the fact that although some theorized attacks were present, I had not seen anything put in practice before, which is what motivated me to prove it was not impossible.

Thanks for the feedback, will be making changes to the blog to clear up some the the things you have outlined here :)

Although this is an attack that can be carried out in practice, it is not quite as scalable as phishing passwords of potentially millions of users across the world. Passkeys are still in general more phish-proof than passwords.

So grad you enjoyed it! Chrome awarded 6000 USD, very grateful for it and will fuel some more security research for a while :)

I can't speak to the prioritization differences between the different browser teams, Chrome was definitely the best which isn't surprising considering their resources. Apple was also quite swift but I imagine it took them some time to decide where to deliver the fix, I myself wasn't sure if this is something that should be blocked at the OS level (the Authentication checking the intent origin) or browser. Mozilla is usually the slowest out of the three but they were still very professional.

Author of the blog here, I actually agree with you the subheading is quite misleading, any tips on what would be more appropriate? "Phishing PassKeys sessions using browser intents" doesn't make much sense to me

Ah thanks missed the typo from the title.