Tag
The article explains how a single XSS vulnerability can defeat the phishing-resistance of passkeys when attestation is set to 'none', allowing attackers to register their own passkeys and achieve persistent account takeover. It calls for attention to this overlooked threat and suggests defenses.
A deterministic action-level attestation architecture for AI mediation was developed and validated in discussions with Microsoft's engineering team. The author seeks investors or partners for the software architecture.