Detecting Compromise of Passkey Storage on the Cloud (CASPER)#
USENIX Security '25 (34th USENIX Security Symposium) digest Program Core pick 13–15 August 2025
Mazharul Islam et al., University of Wisconsin–Madison; Visa Research — Core
- Why: Directly addresses a real gap in FIDO2 passkey deployments: cloud-synced passkeys solve the account-recovery problem but reintroduce a breach surface (the passkey management service's cloud storage) that today's defenses can't close without breaking recovery or login UX.
- What: CASPER, the first framework letting web service providers detect abuse of passkeys leaked from a passkey management service (PMS), even against attackers who strategically adapt to evade detection. (from abstract only)
- How: Integrates into existing passkey backup/sync/authentication flows with minimal UX impact, negligible performance overhead, and low deployment complexity for participating services. (from abstract only — detection mechanism specifics not given)
- Where applicable: General for any relying party accepting FIDO2 synced passkeys; directly actionable for services already on the passkey adoption path.