Opinion: Passkeys Harden Authentication but Leave Enrollment, Recovery and Session Risk Exposed
A SecurityWeek opinion column by Dr. Torsten George (CMO at ID Dataweb) argues that passkeys, while a major improvement over passwords and legacy MFA, do not resolve the broader identity risk problem. Passkeys use public-key cryptography so no reusable secret can be phished, stolen from a database, or replayed in credential stuffing. However, the author notes attackers will shift to the weaker paths around the authenticator: fraudulent account enrollment, account recovery flows, device-change scenarios, and post-authentication session hijacking. The recommendation is to pair passkeys with continuous, risk-based identity threat detection rather than treating a successful login as permanent trust.
Detalhes técnicos
- Passkeys keep the private key on the user's device; only the public key is held by the relying party, providing phishing and adversary-in-the-middle resistance absent in SMS OTP, push notifications, and knowledge-based factors (vulnerable to MFA fatigue and SIM swapping).
- Residual risk areas cited: illegitimate account creation before passkey binding, fallback recovery via password/SMS/email link/help desk, lost or replaced devices, hijacked authenticated sessions, privilege abuse, and account attribute manipulation.
Remediação
- Harden enrollment integrity and re-verify identity before binding a new authenticator or device.
- Avoid weak fallback recovery channels that bypass the passkey.
- Apply continuous risk evaluation using device characteristics, behavioral anomalies, network intelligence, account changes, and transaction context, escalating verification only when risk changes.
Linha do tempo
-
Opinion: Passkeys Harden Authentication but Leave Enrollment, Recovery and Session Risk Exposed
ler a análise desta fonte ocultar
A SecurityWeek opinion column by Dr. Torsten George (CMO at ID Dataweb) argues that passkeys, while a major improvement over passwords and legacy MFA, do not resolve the broader identity risk problem. Passkeys use public-key cryptography so no reusable secret can be phished, stolen from a database, or replayed in credential stuffing. However, the author notes attackers will shift to the weaker paths around the authenticator: fraudulent account enrollment, account recovery flows, device-change scenarios, and post-authentication session hijacking. The recommendation is to pair passkeys with continuous, risk-based identity threat detection rather than treating a successful login as permanent trust.
Technical Details
- Passkeys keep the private key on the user's device; only the public key is held by the relying party, providing phishing and adversary-in-the-middle resistance absent in SMS OTP, push notifications, and knowledge-based factors (vulnerable to MFA fatigue and SIM swapping).
- Residual risk areas cited: illegitimate account creation before passkey binding, fallback recovery via password/SMS/email link/help desk, lost or replaced devices, hijacked authenticated sessions, privilege abuse, and account attribute manipulation.
Remediation
- Harden enrollment integrity and re-verify identity before binding a new authenticator or device.
- Avoid weak fallback recovery channels that bypass the passkey.
- Apply continuous risk evaluation using device characteristics, behavioral anomalies, network intelligence, account changes, and transaction context, escalating verification only when risk changes.