Passkeys are still a big upgrade over passwords — but they are not an invincible force field for regular people. BleepingComputer reported Sept. 4 that researchers have catalogued at least 39 publicly documented attack paths around passkey authentication and the software that surrounds it.
The important split for normals: the FIDO2 cryptography itself is usually still solid. Attackers go after sync, enrollment, recovery, OS/browser UI prompts, and malware already on your device. SpecterOps’ “Pass-the-Passkey” work showed a malicious Windows app can trigger a legitimate-looking WebAuthn prompt, get you to approve it, and walk away with a signed assertion — private key never extracted, account still compromised. Synced vault passkeys (for example via Google Password Manager on Windows) inherit the weaknesses of the phone, cloud account, and password manager that move them around.
Practical takeaways: Prefer a hardware security key for email, banking, and your password manager when you can. Keep your OS and browser updated. Treat unexpected passkey pop-ups like unexpected MFA pushes — deny first, then check the real app. Synced passkeys beat reused passwords; they are not “phishing-proof forever.”
Sources: BleepingComputer; SpecterOps Pass-the-Passkey / Unit 42–style coverage of synced passkey risks on Windows
Leave a Reply