Beginner’s Guide to Bypassing Modern Authentication Methods to SSO

on YouTube ↗41m

" summary

Shows that FIDO/WebAuthn stops phishing but does not stop session replay inside SSO: using Fiddler TLS decryption plus a browser extension to steal cookies and by modifying network packets, the demo replays access and refresh tokens against Azure AD/PingFed, opens the Azure Management portal, and removes the victim’s security key. Proof-of-concept succeeds end-to-end. Proposed mitigations include token binding (dropped by Chrome, Edge-only support) and Microsoft’s preview token protection tied to TPM but currently limited in scope.

AI-written summary · about

" chapters (10)

1. 0:00Modern auth bypass intro
2. 2:55WebAuthn and FIDO2 explained
3. 8:48Session cookie vulnerability
4. 13:51SSO security limitations
5. 18:10SSO token hijack in Azure
6. 21:58Federated auth security risks
7. 23:53Token binding solution
8. 27:12Microsoft’s token protection
9. 29:23Secure auth recommendations
10. 31:11Q&A

" related talks

• 40mThe Attacker’s Guide to SSO and Passwordless TechnologiesAsaf Hecht · RSAC 2021
• 55mYou Shall Not Password: Modern Authentication for Web AppsEli Holderness · Copenhagen Developers Festival 2023
• 01h 14mWebAuthn: Theory and practiceMartin Splitt, Semyon Levenson · HolyJS 2020 Moscow
• 26mTechnical TracksSérgio Ribeiro · IT Security Conference 2025
• 40mGoing passwordless with Web AuthenticationBogdan Arvinte, Mihaita Tinta · Voxxed Days Bucharest 2022
• 56mPasskeys 101: Technical Principles of FIDODavid Turner · Authenticate 2024
• 33mNavigating Passwordless Authentication with FIDO2 & WebAuthnJerrod Chong · BSidesSF 2019
• 47mLet’s stop blaming our users for getting hacked when it is our problem to solveScott Brady · NDC Oslo 2020