Passkeys, the successor to passwords, are becoming more widespread and are meant to better protect online accounts against unauthorized access. Under realistic conditions, though, they can be more dangerous than a classic password. That's what a US study suggests, having examined how people handle passkeys in the context of intimate partner violence. According to the researchers, the results paint a bleak picture of how well people can recognize and defend against the abusive use of passkeys.
Technically more secure, but hard to understand
Passkeys fix a fundamental weakness of the password model. Instead of a shared secret between server and user that can be intercepted, guessed, or exposed in a data breach, they rely on a cryptographic key pair. The private key never leaves the device, and only the public key is stored on the server. Authentication happens locally, via biometrics or a PIN, and phishing isn't just made harder but technically impossible, since a passkey only works for one specific website.
For the study, the research team recruited 31 people with varying backgrounds and technical expertise; about half described themselves as highly technically skilled. They were asked to resolve simulated account takeovers in which someone with access to the credentials had added passkeys for Google, LinkedIn, and PayPal to another device, granting uncontrolled access to the accounts until the relevant passkey was removed from each service. Participants ran into serious trouble here: they either failed outright, or overcorrected and removed every single passkey. They often needed help from the research team.
Warnings that don't help
Many participants were confused by the warning emails services sent when a new passkey was added. Out of concern about phishing, several explicitly avoided clicking any links in them. For Google, the notice led to a help page that didn't actually let users resolve the underlying problem of the malicious passkey. For PayPal and LinkedIn, it was unclear what steps to take next, and the respective security settings offered little help either, partly because passkeys were hard to name and distinguish clearly.
The majority of participants couldn't tell when an attacker with access to a password had added their own passkey, and failed to remove it without assistance even when they realized something was wrong. In one case, someone mistook the display of two separate passkeys for a single passkey shared across two devices. Lead author Alaa Daffalla of Cornell University calls the lack of understanding of the concept, especially among technically skilled people, surprising. Overall, she says, it's somewhat concerning that more and more people are using passkeys without really understanding how they work. The study was presented at the USENIX Security Symposium in Baltimore.
What this means for providers
This points to a clear need for action among online services: warning notices should lead directly to a fix for the problem instead of pointing users to generic help pages, and security settings should name and distinguish passkeys clearly. Until then, if you use passkeys, you should regularly check which devices and passkeys are registered on your most important accounts and remove any unfamiliar entries right away.