The Hardening Reality of Passkey Security: Beyond Phishing Resistance
The Hardening Reality of Passkey Security: Beyond Phishing Resistance
Passkeys have been lauded as a revolutionary step in authentication, promising an end to phishing attacks by eliminating shared secrets and tying authentication directly to devices. This vision holds immense appeal for enterprise security teams grappling with persistent credential-based threats. However, recent disclosures reveal a hardening reality: while passkeys inherently resist traditional phishing, their surrounding implementations can introduce new vulnerabilities and attack vectors. Enterprise organizations must look beyond the initial promise and rigorously evaluate the complete passkey ecosystem.
The Allure and Limitations of Passkeys
Passkeys leverage public-key cryptography, where a unique cryptographic key pair is generated for each online account. The private key remains securely on the user's device (e.g., a smartphone, hardware security key, or TPM), while the public key is registered with the service provider. Authentication occurs when the user's device cryptographically proves possession of the private key, typically unlocked via biometrics or a PIN. This design makes passkeys highly resistant to phishing, as there is no shared secret to steal and the authentication is cryptographically bound to the legitimate service domain.
Major players like Microsoft are driving passkey adoption, with Microsoft Entra ID now defaulting to passkeys and planning to deprecate SMS and voice authentication by early 2027. This signals a significant industry shift towards a passwordless future. The UK's National Cyber Security Centre (NCSC) has also endorsed passkeys for their phishing resistance.
Emerging Attack Vectors: "Pass-the-Passkey" and Synced Credential Theft
Despite their phishing resistance, recent research has highlighted vulnerabilities in passkey implementations and ecosystem components. A family of techniques, dubbed "Pass-the-Passkey" by SpecterOps principal researcher Michael Grafnetter, bypasses MFA without breaking FIDO2 directly. These attacks do not extract private keys from hardware modules but can still yield privileged sign-ins. One notable flaw, CVE-2026-34348, involved Windows storing YubiKey signatures in cleartext in event logs, which Entra ID subsequently accepted, allowing for authentication bypass if an unprivileged user could access these logs [6].
Another critical area of concern involves synced passkeys. The FIDO2 specifications allow passkey managers to store passkeys locally in regular storage, rather than exclusively in dedicated hardware like a TPM or Secure Enclave. This can create vulnerabilities. Attacks like "Pass-ta-Key" exploit this by potentially extracting all locally synced passkeys, particularly when managed by Google Password Manager in Chrome for Windows, and using them for unauthorized logins [7, 9]. This underscores that while the FIDO2 cryptography remains sound, "everything built around it" presents a new attack surface.
Implications for Enterprise Security Teams
For enterprise security architects and IAM engineers, these developments necessitate a refined approach to passkey adoption and governance:
- Hardware-Backed Passkeys are Paramount: Prioritize solutions that enforce hardware-backed passkeys wherever possible. Devices with TPMs, Secure Enclaves, or dedicated security keys (like YubiKeys) offer a significantly stronger security posture by isolating private keys. OpenAI's Advanced Account Security (AAS) program, for instance, now mandates hardware-backed passkeys for its "Trusted Access for Cyber" members, demonstrating this critical shift [10].
- Comprehensive Endpoint Security: The "Pass-the-Passkey" attacks highlight the importance of robust endpoint security. If an attacker can compromise an endpoint to access local passkey stores or event logs, the phishing resistance of passkeys becomes moot. This includes strong antivirus, EDR solutions, least privilege access, and rigorous patching.
- Audit and Monitor Passkey Implementations: Understand how passkeys are stored and managed across your enterprise. This includes auditing third-party applications and identity providers for their specific FIDO2 implementations. Ensure that passkey registration and usage are logged and monitored for anomalous activity.
- Strong Governance and Policies: Establish clear policies for passkey provisioning, revocation, and recovery. Implement controls to prevent the use of easily compromisable passkey storage mechanisms, particularly for high-value accounts.
- User Education and Awareness: While passkeys reduce the threat of phishing, users still need education on secure device hygiene and the dangers of malware that could compromise their local passkey stores. Emphasize that passkeys are not a magic bullet against all forms of compromise.
- Cryptographic Agility: The evolving threat landscape reinforces the need for cryptographic agility within your enterprise infrastructure. The ability to quickly adapt to new cryptographic standards and address emerging vulnerabilities in authentication mechanisms is crucial for long-term security.
Conclusion
Passkeys undeniably offer significant security advantages over traditional passwords, particularly in their resistance to phishing. However, the enterprise journey towards a truly passwordless future is complex. Security teams must recognize that the "phishing-proof" narrative applies primarily to the FIDO2 protocol itself, not necessarily to every possible implementation and the surrounding ecosystem. By prioritizing hardware-backed solutions, bolstering endpoint security, implementing stringent governance, and maintaining cryptographic agility, organizations can effectively leverage passkeys to enhance their overall security posture and navigate the evolving authentication landscape with confidence.