Passkeys Aren't Magic: Researchers Map 39 Ways to Sidestep Them
A new catalogue from Token shows attackers don't need to break the cryptography behind passkeys to steal accounts. They just walk around it.
Key points
- Researchers at Token have documented 39 ways to defeat passkey logins without breaking the underlying cryptography.
- The attacks target enrollment, recovery, synced credentials and the login prompt itself, not the FIDO2 standard behind passkeys.
- Passkeys still remove most password-based risks like credential stuffing and mass phishing, but they are not a total fix.
- Weak account recovery, where users can fall back to a password or a text message, remains the softest target.
- Organisations rolling out passkeys need to lock down enrollment and recovery, not just the login screen.
Passkeys were sold as the end of the password era. A new writeup, first reported by BleepingComputer, is a useful reminder that the login box is only one part of the story.
Security firm Token has published a catalogue of 39 techniques that criminals can use to bypass passkey logins. None of them break the cryptography. They all pick the locks around it.
What is a passkey, in plain English?
A passkey is a login method that replaces your password with a secret stored on your phone or laptop, unlocked by your fingerprint, face or device PIN. It's built on a standard called FIDO2, designed by an industry group to stop the classic tricks: guessing passwords, stuffing stolen ones into other sites, or phishing them through fake login pages.
The cryptography works. Token isn't arguing otherwise. What the researchers describe is closer to a burglar who doesn't pick the front-door lock. They ring the bell, pretend to be the cleaner, and get let in.
How do the 39 attacks actually work?
They abuse the trust boundaries around the passkey, not the passkey itself. Think of the moments when a site has to make a judgement call about who you are: setting up the passkey in the first place, recovering your account when you lose your phone, syncing your credentials to a new device, or showing you a login prompt you didn't ask for.
Token groups the techniques into a handful of buckets:
| Attack surface | What goes wrong |
|---|---|
| Enrollment | An attacker registers their own passkey on your account before you do |
| Recovery | The "I lost my device" flow falls back to a password or a text message |
| Synced credentials | A compromised cloud account (Apple, Google, Microsoft) hands over the passkey |
| Login prompts | Users are tricked into approving a login they didn't start |
| Session handling | Attackers steal the cookie issued after a valid passkey login |
None of this is exotic. Session cookie theft is as old as web banking. Tricking someone into approving a prompt is the same pattern that broke Uber and Cisco in 2022, only with a different button to tap.
Should ordinary users worry?
Not much, and definitely not enough to go back to passwords. Passkeys still kill off the biggest categories of account theft, including bulk phishing and reused-password attacks. If your bank or your email provider offers a passkey, turn it on.
The practical advice for a normal person is short. Be suspicious of any login prompt that pops up when you weren't trying to log in. If a site lets you delete the old password after adding a passkey, do it. And keep your Apple, Google or Microsoft account, where your passkeys are stored, protected with its own strong second factor.
What should companies rolling out passkeys do?
Stop treating the login screen as the whole problem. Most of Token's 39 techniques hit enrollment and recovery, the two flows that engineers tend to design last and test least.
That means checking who is allowed to register a passkey on an account, and when. It means killing password fallbacks once a passkey exists, or at least gating them behind something stronger than an SMS code. And it means logging and alerting on passkey changes the same way you would on a password reset.
The headline number, 39, will get the clicks. The useful takeaway is quieter: authentication is a system, not a login box, and passkeys only fix the parts you actually plumb in properly.
