Passkeys: What They Change for Account Security and What Remains Fragile

The short version

Passkeys are cryptographic credentials designed to replace passwords, but they are not a magic shield that makes an account invulnerable. They are FIDO cryptographic credentials tied to a user's account on a website or application, leveraging the device's hardware to prevent phishing attacks that trick users into typing passwords.

However, the security of a passkey depends heavily on how it is stored and managed. While they eliminate the risk of a stolen password being reused elsewhere, recent research shows that neither synced passkeys nor device-bound passkeys fix implementation mistakes elsewhere in the chain. The choice between a key that stays on one device and one that syncs across a cloud ecosystem involves trade-offs in convenience versus exposure to malware already present on a victim's machine.

This guide decodes the mechanism: how passkeys work, why they stop classic phishing, and where the remaining risks lie when a device is compromised.

How it works

To understand the shift, one must first understand what a passkey is and what it is not.

A passkey is a cross-platform general-use term, not a feature tied to any specific vendor like Apple or Google. It functions as a pair of cryptographic keys. The private key never leaves the secure enclave of the user's device (or a dedicated hardware key), while the public key is shared with the service provider.

When a user logs in, the service sends a challenge. The device signs this challenge with the private key. Because the private key is bound to the device and often protected by a biometric or PIN, a remote attacker cannot simply "guess" or "steal" the credential in the way a text-based password is stolen.

Adoption is already significant. In a 2024 independent survey commissioned by the FIDO Alliance, 53% of people reported enabling passkeys on at least one of their accounts, with 22% enabling them on every account they possibly can.

The mechanism relies on two main storage models:

1. Device-bound: The key exists only on a specific physical device. If that device is lost, the key is gone unless a backup was created elsewhere. This offers high isolation.
2. Synced: The key is encrypted and copied across multiple devices (e.g., via a cloud account like iCloud or Google Password Manager). This offers convenience but introduces a different attack surface.

What is sourced

The core claims regarding passkey mechanics and adoption rest on official standards bodies and verified industry surveys.

• Definition and Scope: The FIDO Alliance defines passkeys as cryptographic credentials tied to a user's account. This definition is the baseline for all major implementations, ensuring that a passkey created on a Windows PC can theoretically be used on an Android phone if synced.
• Adoption Data: The statistic that 53% of users have enabled passkeys on at least one account comes from a 2024 survey commissioned by the FIDO Alliance. This indicates a rapid shift from niche security tools to mainstream authentication.
• Government Guidelines: The U.S. National Institute of Standards and Technology (NIST) provides technical requirements for digital identity services. While these guidelines focus on federal agencies, they establish the baseline for what constitutes a secure authentication method, often referencing FIDO standards.

Caveats

Despite their strength against phishing, passkeys do not eliminate all account risks. The security of a passkey is only as strong as the device holding it and the software managing it.

Recent findings from security researchers highlight that no single choice between synced and device-bound passkeys closes the broader attack surface.

The Synced Key Risk When a passkey is synced across devices, it relies on a cloud service to manage the encryption keys. Research has demonstrated attacks where malware already present on a victim's machine can recover the private keys for synced passkeys. This does not involve "breaking" the cryptography; rather, it exploits the trust relationship between the operating system and the cloud sync service.

The Device-Bound and Endpoint Risk Even if a key is strictly bound to a single device, it is not immune if the device itself is compromised. Techniques such as malware-initiated phishing and interception can work across relying parties and authenticators. For example, researchers have shown that malware running in a signed-in Windows session can sometimes use a hardware-bound key without asking the user for a fresh PIN or biometric check, leveraging existing session tokens.

Furthermore, neither synced passkeys nor device-bound passkeys fix implementation mistakes elsewhere in the chain. If a service provider fails to verify the origin of a request or if a user's device is infected with sophisticated malware that intercepts authentication signals, the passkey's cryptographic strength may be bypassed.

A Microsoft spokesperson noted that organizations should adopt a least-privilege access approach, use phishing-resistant authentication methods, and maintain endpoint protections by embracing a Zero Trust security model. This underscores that passkeys are a component of a larger security posture, not a standalone solution.

What's next

The evolution of passkey security will likely focus on narrowing the gap between convenience and isolation.

• Endpoint Hardening: As attacks shift from stealing passwords to compromising the device itself, the focus will move toward better endpoint protection and Zero Trust architectures.
• Recovery Mechanisms: Users will need clearer, more secure ways to recover access if a device is lost or stolen, without reverting to weak passwords.
• Standardization: Continued updates to WebAuthn and FIDO standards will aim to close the specific vulnerabilities found in current implementations, such as the relay attacks and session hijacking techniques recently documented.

For the average user, the immediate takeaway is that passkeys are a significant upgrade over passwords for preventing phishing. However, they should be viewed as a strong lock on a door, not a guarantee that the house is immune to a burglar who already has a key to the window.

Going further

• FIDO Alliance Passkeys Overview — The official source for the definition of passkeys and adoption statistics.
• NIST Digital Identity Guidelines — Technical requirements for digital identity services from the U.S. government.
• New Passkey Attacks Analysis — A detailed report on recent vulnerabilities affecting synced and device-bound keys.