You finally did it. You switched to passkeys. No more passwords, no more phishing. Congratulations — you are now more vulnerable than ever.
Here’s the truth nobody wants to say: Passkeys don’t eliminate the attack surface. They just move it from your brain to your device. And your device is a lot easier to compromise than your memory.
Unit 42 researchers just proved it. They demonstrated a class of attacks — ironically called ‘Pass the Passkey’ — that show how an attacker with local access to your machine can extract the keys that unlock your entire digital life. But here’s the twist: the attack isn’t on the passkey protocol. It’s on the trust infrastructure around it.
You’ve probably heard that passkeys are ‘unphishable.’ That’s true — in the narrow sense that an attacker can’t trick you into typing a secret. But they can trick your device. Or they can steal the vault that stores your passkeys. Or they can tamper with the TPM that signs the handshake.
One security researcher told me: ‘These are not passkey attacks. They’re endpoint attacks.’ He’s right. But that doesn’t make them less dangerous. It just means we’ve been focusing on the wrong threat.
Think about it. The whole pitch for passwordless was: ‘No more shared secrets, no more phishing.’ But what we’ve done is concentrate all the value into a single point — your device. Lose control of that device, and the attacker doesn’t need your password. They don’t need your passkey. They just need to sit quietly on your machine and wait for you to authenticate.
This is the uncomfortable reality: Passwordless doesn’t make you safer. It makes you a bigger target.
I’m not saying passwordless is bad. I’m saying it’s dangerous to think it’s a silver bullet. The convenience comes at a cost — and that cost is endpoint integrity. If you don’t have rock-solid malware protection, if you don’t have device monitoring, if you don’t assume your endpoint is already compromised, you’re building a fortress on a swamp.
One of the most telling comments on the Unit 42 article said: ‘If you have this level of local privileges, you can just read session cookies.’ Exactly. The attacker doesn’t need to break the passkey. They need to break you.
The protocol is sound. The implementation is not. And that’s the kind of distinction that gets people hacked.
So before you go all-in on passwordless, ask yourself: Do you trust your endpoint more than you trust yourself? If the answer is yes, you’re not paying attention.
Passwordless isn’t the end of the attack surface. It’s the beginning of a new one.
FAQ
Q: Does this mean passkeys are useless?
A: No. Passkeys are a significant improvement against remote phishing attacks. But they are not a silver bullet. The security model shifts trust to the endpoint, which must be defended just as aggressively as passwords were.
Q: What should I do to protect my passkeys?
A: Treat your device as a high-value asset. Use endpoint detection and response (EDR), keep your OS and software updated, avoid installing untrusted apps, and enable strong device authentication (like biometrics) with PIN fallback. Also, consider using a dedicated hardware security key for critical accounts.
Q: Are there any attacks that directly break the passkey protocol?
A: Not yet. The attacks demonstrated so far exploit the surrounding infrastructure — password manager vaults, TPM handshakes, and OS-level compromises. The protocol itself remains cryptographically sound. However, the security of the whole system depends on the weakest link, which is now the endpoint.