Passkeys Are Not Completely Secure After All, Unless They Are Tied to Dedicated Biometric Hardware

Seven sections: the nine stages of the Entra enrollment campaign, why the credential itself was never compromised, and the point where the attack fails. Start with the executive summary. It sets out the distinction the rest of the paper depends on, that the attacker exploited enrollment, not cryptography.