39 New Methods That Compromise Passkey Authentication
Security researchers have identified 39 distinct methods attackers can use to compromise passkey-based authentication systems. The techniques do not break the underlying FIDO2 cryptography but instead target surrounding processes like credential syncing, enrollment flows, account recovery, and how authentication prompts are handled.
Why this matters: Passkeys were sold as the fix for passwords. That story is not wrong, but it is incomplete. Attackers do not need to crack cryptography if they can abuse the seams around it — recovery flows, synced credentials, device prompts. These are the parts built for convenience, and convenience is usually where security falls apart. If you switched to passkeys and assumed the problem was solved, this research is a reason to look more carefully at how your accounts handle enrollment and recovery, not just login.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.