An introduction to Passkey Editor, the Burp Suite extension that unwraps WebAuthn traffic into an editable view and automates ceremony-layer attacks. Published on the Anvil Secure blog.

A look at passkey architecture: device-bound vs synced credentials, the three authenticator categories, and real-world deployment pitfalls like magic link fallbacks and signature counters. Published on the Anvil Secure blog.

A deep dive into the WebAuthn/CTAP protocol that powers passkeys, breaking down what actually happens on the wire during registration and authentication. Published on the Anvil Secure blog.