Passkeys: Convenience Risks in Recovery and Dependencies

The Pitfalls of Convenience and Recovery

A central promise of Passkeys is the immense improvement in user experience. No more typing long passwords, no need to remember complex character strings. Once set up, logging in should be seamless. But this is precisely where one of the biggest challenges lies: recovery. What happens if you lose the only device on which your Passkeys are stored? Traditional password recovery methods – like resetting via email – don’t work here, as the Passkeys themselves, not a retrievable password, enable authentication. While there are approaches to synchronizing Passkeys via cloud services, which are intended to facilitate recovery, this synchronization carries its own security risks, as newly discovered vulnerabilities have shown [1]. The reliance on a functioning cloud backup system or the necessity of manually transferring Passkeys to new devices can quickly become a nightmare if not planned carefully. Hardware-based storage, such as that implemented with the “DLHStick” (from version 1.6.0 of the user manual) and its security concept, could bypass this cloud dependency but also brings its own complexities and considerations.

A Fragile Ecosystem and New Dependencies

The widespread adoption of Passkeys heavily depends on support from browsers, operating systems, and the services we use daily. This inevitably leads to a certain ecosystem dependency. If a particular provider – be it Apple, Google, or Microsoft – changes or discontinues its Passkey implementation, users might be forced to migrate all their credentials. This carries the risk of vendor lock-in, where you become tied to the technologies and platforms of a single provider. The idea that Passkeys solve phishing problems, which pose significant financial risks for banks [4], is appealing. But what happens if the underlying infrastructure that enables the synchronization and management of Passkeys is compromised? The dependence on cloud providers offering their own security solutions with products like Kaspersky Premium or Kaspersky Password Manager [5] could become even more complex in the future if these providers also handle Passkey synchronization. The security and integrity of these central synchronization services are therefore crucial and represent a new potential attack vector.

Implementation Risks and Future Monitoring

For developers and companies looking to adopt Passkeys, new challenges arise. The implementation requires a deep understanding of the underlying cryptographic principles and the WebAuthn API. Errors in implementation can create new vulnerabilities that attackers could exploit. While Passkeys reduce the risk of phishing based on password theft, new attack vectors could emerge that focus on the handling of cryptographic keys or the synchronization mechanisms. Furthermore, Passkeys raise questions regarding long-term monitoring and governance. Since keys are stored on devices and often synchronized via clouds, there is theoretically the possibility of centralized or decentralized monitoring of login activities. Who has access to this data? How is it protected? The need for continuous observation and adaptation of security strategies is considered important [4]. The development of standards and best practices for the secure implementation and management of Passkeys is still ongoing, and it remains to be seen how these challenges will be overcome. The introduction of Passkeys is a significant step towards a passwordless future, but it is not a silver bullet. The supposed revolution harbors new risks, ranging from usability and recovery to ecosystem dependencies and new attack vectors. A careful consideration of these pitfalls is essential to ensure that the future of authentication is truly more secure, not just different.