How to mitigate account enumeration risks with passkeys?

Account enumeration risks occur when an attacker can determine whether an account exists based on system responses during login. In passkey implementations, this risk often arises with methods like the "Identifier-First Approach." Here’s how organizations can mitigate these risks:

• Use tools like CAPTCHAs (e.g., Cloudflare Turnstile) to prevent automated attacks that attempt to identify valid accounts.
• Monitor traffic patterns to detect and block suspicious activity.

Avoid exposing whether an account exists by using generic error messages. For example: Instead of "This email is not registered," display "Login failed. Please check your credentials."

• Limit the number of login attempts or identifier lookups per IP address or session.
• Introduce delays between repeated attempts to deter brute-force enumeration attacks.

• Require additional verification steps (e.g., CAPTCHA or SMS) after a certain number of failed attempts.
• Use adaptive authentication techniques to dynamically adjust security measures based on risk levels.

• Track unusual patterns, such as high volumes of failed identifier checks, and flag or block potentially malicious activity.
• Use advanced threat detection tools to identify and respond to enumeration attempts.

Inform users about the importance of using unique, strong identifiers (e.g., usernames or email addresses) to reduce vulnerability to enumeration attacks.

By adopting these strategies, organizations can safeguard user privacy and security without compromising the user experience in their passkey implementation.