Forging Passkeys: Exploring the FIDO2 / WebAuthn Attack Surface

Passwords are dying and passkeys are taking over. In this post we tear apart WebAuthn and build our own software FIDO2 authenticator from scratch.