[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-503599-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-503599-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","detecting-compromise-of-passkey-storage-on-the-cloud-casper-paper","Detecting Compromise of Passkey Storage on the Cloud - CASPER Paper","","FIDO synced passkeys enable cloud backup of FIDO2 private signing keys, addressing account recovery for device loss. This convenience creates a serious threat: breaches of passkey management services (PMS) cloud storage let attackers steal passkeys and take over accounts. Existing defenses cannot remove the risk without breaking recovery or affecting normal login. The paper introduces CASPER, a passkey breach detection framework enabling relying parties to detect abused leaked passkeys. CASPER remains effective even against adaptive attackers and can integrate with backup, synchronization, and authentication with minimal impact.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/technology/","Technology",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/detecting-compromise-of-passkey-storage-on-the-cloud-casper-paper/503599/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/detecting-compromise-of-passkey-storage-on-the-cloud-casper-paper/503599.png","ImageObject",300,407,{"name":42,"@type":43},"Olivia Brown","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-20","2026-10-03",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",10,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What security risk does synced passkey backup to cloud storage introduce?","Question",{"text":63,"@type":64},"Attackers can steal users’ passkeys through breaches of the passkey management services (PMS) cloud storage, then use the stolen passkeys to take over web service accounts.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How does CASPER detect unauthorized login attempts using leaked passkeys?",{"text":68,"@type":64},"CASPER uses a decoy-based technique that hides the real passkey among indistinguishable decoy passkeys. When an attacker attempts to log in, they are likely to use a decoy passkey, triggering breach detection at the relying party.",{"name":70,"@type":61,"acceptedAnswer":71},"How is the real passkey protected during backup and recovery in the CASPER design?",{"text":72,"@type":64},"The passkey backup and restoration (BnR) protocol encrypts real passkeys under a recovery key retrievable using a user secret η known to the user. Without η, an attacker cannot reliably distinguish real passkeys from decoys except by attempting logins.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},503599,1791158122,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,101,105,110,115,120,123,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":97,"doc_module":4,"doc_module_name":25,"category_name":98,"show_sort_weight":99,"slug":100},5,"Comic",60,"comic",{"id":102,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":103,"slug":104},6,50,"technology",{"id":106,"doc_module":4,"doc_module_name":25,"category_name":107,"show_sort_weight":108,"slug":109},7,"Healthcare",40,"healthcare",{"id":111,"doc_module":4,"doc_module_name":25,"category_name":112,"show_sort_weight":113,"slug":114},8,"Research & Report",30,"research-report",{"id":116,"doc_module":4,"doc_module_name":25,"category_name":117,"show_sort_weight":118,"slug":119},9,"Religion & Spirituality",20,"religion-spirituality",{"id":118,"doc_module":4,"doc_module_name":25,"category_name":121,"show_sort_weight":118,"slug":122},"World Cup","world-cup",{"id":55,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":55,"slug":125},"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":97,"slug":129},19,"General","general",{"code":4,"msg":82,"data":131},{"doc_id":79,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":102,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":118,"language":139,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":12,"update_tm":143,"read_time":103},16904993612988,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","Detecting Compromise of Passkey Storage on the Cloud  \nMazharul Islam∗3, Sunpreet S. Arora‡, Rahul Chatterjee3 , Ke Coby Wang† ‡  \n3 University of Wisconsin—Madison, ‡Visa Research  \nAbstract  \nFIDO synced passkeys address account recovery challenges by enabling users to back up their FIDO2 private signing keys to the cloud storage of passkey management services (PMS) . However, it introduces a serious security risk—attackers can steal users’ passkeys through breaches of PMS’s cloud storage. Unfortunately, existing defenses cannot eliminate this risk without reintroducing account recovery challenges or disrupting users’ daily account login routines. In this paper, we present CASPER, the first passkey breach detection framework that enables web service providers to detect the abuse of passkeys leaked from PMS for unauthorized login attempts. Our analysis shows that CASPER provides compelling detection effectiveness, even against knowledgeable attackers who strategically optimize their attacks to evade CASPER’s detection. We also show how CASPER can be seamlessly integrated into the existing passkey backup, synchronization, and authentication processes, with only minimal impact on user experience, negligible performance overhead, and minimum deployment and storage complexity for the participating parties.  \n1 Introduction  \nFIDO2-based user authentication has compelling security guarantees which allows users to log into their web service accounts with device-bound private keys. While they are promising at (finally) replacing passwords, recovering accounts in the event of device loss remains a significant challenge preventing the adoption of FIDO2 . To address this challenge and accelerate the adoption of FIDO2-based passwordless user authentication, Microsoft, Apple, and Google announced passkeys [1], which enables cloud backup and multi-device synchronization of FIDO2 private keys. Today, there are many passkey management services (PMS) that allow passkey backup, e.g., iCloud Keychain from Apple [14], Google Password Manager [12], Password Monitor from Microsoft [11], 1Password  [5], LastPass [4], and DashLane [3] .  \n∗ Work partially done during a research internship at Visa Research.  \n†Corresponding author: [coby.wang@visa.com](coby.wang@visa.com)  \nWhile synced passkeys address the account recovery concern, backing up passkeys to a centralized cloud server poses a serious security risk: attackers can steal users’ passkeys through PMS breaches and use them to take over users’ web service accounts. The breach can happen when an attacker compromises a user’s PMS account (possibly by guessing the account password) or when an insider attacker gains access to the cloud backup storage [27, 82]. Unfortunately, existing passkey backup and synchronization implementations lack the capability to detect unauthorized access to users’ passkeys stored at the PMS.  \nIn this paper, we address this problem by proposing CASPER 1 , which, to the best of our knowledge, is the first framework to detect the abuse of passkeys leaked from PMS. Underlying CASPER is a decoy-based detection technique [30, 50, 75]: it hides the real passkey within a list of decoy passkeys that are indistinguishable from the real one. As a result, an attacker who steals the passkeys from PMS and attempts to use them to log into the user’s account at a relying party (RP), e.g., a website, inadvertently will end up using a decoy passkey with high probability. These login attempts will trigger breach detection at the RP, indicating the abuse of passkeys stolen from the PMS. However, unlike focusing on allowing relying parties (RP) to detect breaches of their own password databases, as explored in prior works [30, 50, 75], CASPER enables the relying parties to detect breaches of PMS—a different service. To do so, there are additional usability challenges that CASPER must overcome. For example, false detections by a denial-of-service attacker must be avoided, as they would un","cbCaijB0y88dNja5","https://ap.wps.com/l/cbCaijB0y88dNja5","pdf",625240,"English","# Introduction\n## Background on FIDO2 and passkeys\n## Security risk from synced passkeys stored in PMS\n## CASPER approach and decoy-based detection idea\n## CASPER design goals: usability and false detection avoidance\n# Proposed system design\n## Passkey backup and restoration (BnR) protocol\n## Compromise detection (CD) algorithm","[{\"question\":\"What security risk does synced passkey backup to cloud storage introduce?\",\"answer\":\"Attackers can steal users’ passkeys through breaches of the passkey management services (PMS) cloud storage, then use the stolen passkeys to take over web service accounts.\"},{\"question\":\"How does CASPER detect unauthorized login attempts using leaked passkeys?\",\"answer\":\"CASPER uses a decoy-based technique that hides the real passkey among indistinguishable decoy passkeys. When an attacker attempts to log in, they are likely to use a decoy passkey, triggering breach detection at the relying party.\"},{\"question\":\"How is the real passkey protected during backup and recovery in the CASPER design?\",\"answer\":\"The passkey backup and restoration (BnR) protocol encrypts real passkeys under a recovery key retrievable using a user secret η known to the user. Without η, an attacker cannot reliably distinguish real passkeys from decoys except by attempting logins.\"}]","Detecting Compromise of Passkey Storage on the Cloud - CASPER Paper | PDF",1791058557]