René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"iOS Safari misroutes YubiKey NFC registration to platform-bound passkeys — no roaming credential created + Outlook password prompts on passwordless account","articleBody":"\nI’m reporting a multi-layered issue affecting mobile security workflows across Microsoft and Apple platforms:\n\n1. YubiKey Misregistration via Safari/iOS\nAttempting to register a physical YubiKey 5 NFC with my personal Microsoft account using Safari on iPhone (iOS 18.5) consistently results in creation of platform-bound passkeys stored in iCloud Keychain. These are mislabeled in the dashboard as “Yubikey” credentials but are tied to the device, not the hardware token. No option to register a true roaming FIDO2 credential appears in the mobile flow.\n2. Misleading Credential Labeling\nThe credentials appear under “Passkeys” and are stored in the Secure Enclave, yet are named “Yubikey Prime” or “Yubikey Secondary,” creating a false sense of hardware-backed security. This undermines MFA enforcement and cross-device portability.\n3. Passwordless Account Conflict\nMy Microsoft account is configured as passwordless, meaning fallback to password is disabled. The misregistration of platform-bound passkeys creates a dangerous mismatch—especially since fallback methods (Face ID, SMS, Authenticator) remain active and Outlook repeatedly prompts for login credentials on iOS.\n4. Mobile Feedback Limitations\nMicrosoft’s feedback forms on mobile Safari:• Disable paste, preventing technical narratives from being submitted\n• Claim screenshot upload is supported, but no such option appears\n• These limitations make it nearly impossible to report bugs from the affected platform\n\n5. Cross-Vendor Accountability\nThese issues span Microsoft, Apple, and Yubico ecosystems. Users enforcing hardware-only authentication and secure mobile workflows are left with:• Misregistered credentials\n• Inaccurate dashboard labeling\n• Broken feedback channels\n• Repeated password prompts that degrade trust and usability\n\n\n\nRequest for Action:\n\n• Microsoft: Clarify mobile support for true FIDO2 credential registration and fix misleading passkey labeling\n• Apple: Investigate persistent Outlook password prompts and restore feedback form functionality\n• Yubico: Confirm whether SDK or platform constraints contribute to fallback behavior on iOS Safari\n\n\nScreenshots and forensic traces available upon request. I’m happy to provide credential origin metadata, NFC handshake logs, and dashboard captures to support escalation.","author":{"url":"https://github.com/SA5760010","@type":"Person","name":"SA5760010"},"datePublished":"2025-07-22T20:05:57.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/2/.github/issues/2"}