Harnessing Passkeys in the Battle Against Al-Powered Cyber Threats
summary
Claim: passkeys block the primary AI-scaled attack vector where adversaries use LLMs plus automation to turn OSINT into realistic spearphish. The demo shows an autonomous “crew” built from LLMs (ChatGPT, Llama 3) and no-code pair programmers (AER chat) that pulls employee profiles with proxycurl, searches via Serper, composes tailored emails, and harvests sessions with Evil Jinx. 3.8 billion leaked passwords make fallback resets the weakest link, so recovery shifts to ID‑verification and issuing device‑bound passkeys.
AI-written summary · about
chapters (13)
- 0:00Introduction and setup
- 1:08Why passkeys matter now
- 3:14AI-powered threats overview
- 7:25Automated phishing attack demo
- 10:56Identity chain weaknesses
- 13:20Fallbacks are the weakest link
- 16:46Physical-to-digital identity link
- 18:16Q&A on account recovery
- 19:41Next wave of AI threats
- 21:26Onboarding passkey workflow
- 23:57Device-bound vs synced passkeys
- 25:01Multi-IDP enterprise challenges
- 26:48Q&A wrap-up and thanks
related talks
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
34mLLM Security 101 - An Introduction to AI Red Teaming
30mAuthentication for humans, why passkeys finally make sense.
31mLog In Through the Front Door: Automating Defense Against...
47mPasswordless Web
41m📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
38mPhishing LLMs: Reeling in the Machine
31mAdvanced Persistent Teenagers: Understanding the Lapsus$ Playbook