← Back to context

Comment by autoexec

5 days ago

Passkeys can be, and have been, stolen and hijacked. They make it more difficult for scammers and hackers to get into your accounts, but not impossible. How many phishing emails have you personally fallen for that this is your #1 concern over the fragility and complexity of passkeys?

7 comments

autoexec

Reply
MBCook  5 days ago

As far as I know, it has never happened. I know there was a presentation or two on bugs in individual password managers.

But that is not a flaw in passkeys. And there have been bugs in password managers that expose standard passwords as well.

  • autoexec  5 days ago

    > But that is not a flaw in passkeys.

    By that reasoning passwords are 100% secure too, it's the human's fault when they fall for phishing sites! Passkeys depend on humans, password managers, devices, certificate authorities, browsers, and operating systems. That's not even including the implementation itself (https://www.esentire.com/blog/securing-passkeys-thwarting-au...)

    All of this means that even when you're using a passkey an attacker could still break into your accounts. Passkeys can make it harder for them, but it can make it harder for you to get access to your accounts too. For me, I don't think the risk of phishing is worth the trouble passkeys would cause me.

jt2190  5 days ago

Can you provide details on this attack?

Typically the user gives a website their public passkey, which does not need to be kept secret since it’s public. If the website is hacked the attackers only get information that is already public.

You seem to be talking about a scenario where a user’s private keychain on their computer is compromised and the attacker is able to access other systems from that same machine without the user’s knowledge. (Note that the keychain data is itself encrypted so can’t be used from a different computer.)

  • autoexec  5 days ago

    There are a lot of examples of attacks and bypasses, but this one is probably the worst I've seen so far https://www.techtimes.com/articles/323093/20260805/google-pa...

    It's not just the end user that you have to worry about, attacks are helped by the fact that websites suck at passkeys too

    "...we developed PASSKEYS-ATTACKER. The tool allows for precise manipulation of WebAuthn messages at every step of the protocol and integrates 15 attack types of which 10 were not covered in previous work. Among them, 2 attack types have critical CVSS scores. We discovered them on 18 out of 103 evaluated websites. These attacks take over user accounts, delete their passkeys, or lock them out of their accounts. Nearly half of the tested sites (53) were vulnerable to at least one attack with a high CVSS score, exposing users to threats such as phishing and session fixation." https://www.usenix.org/conference/usenixsecurity26/presentat...

whyagaindavid  5 days ago

> Passkeys can be, and have been, stolen and hijacked.

Proof needed.

> How many phishing emails h

The point is the average Joe will not be phished - especially important stuff - like email or eBay or bank. That is the reason for passkey.

Yes, many people in HN can avoid scammers.