Comment by autoexec | Hacker News Reader

Top New Best Ask Show Jobs

Comment by autoexec | Hacker News Reader

Parent Full thread

> The only sense in which passkeys have anything to do with this at all is that the attackers used the word "passkey" in their emails.

That's wrong. They attackers actually go on to create a real passkey that gives their device access to the compromised account.

Accounts that are already protected by passkeys can still be vulnerable too. see:

https://www.forbes.com/sites/zakdoffman/2025/08/28/yes-your-...

https://www.esentire.com/blog/securing-passkeys-thwarting-au...

https://unit42.paloaltonetworks.com/passwordless-authenticat...

Right, if you phish the credentials to an account that is not protected by a passkey, one thing you can now do is set up your own passkey on it. That's exactly what passkeys would've protected the victim against!

The other articles you've linked also describe attacks against accounts that allow non-passkey logins, or attacks that require a compromised browser.

There will never be a login that doesn't involve a potentially compromised device/OS/browser/password manager. As long as using a passkey means using those things too, having a passkey isn't enough to keep attackers out of your accounts. They can be pretty good about keeping legitimate users out of their accounts though. You just have to weigh that risk against the risk of you falling for a phishing attack.

Security is never perfect, if your device is already compromised, you have bigger issues. None of the traditional methods would protect against compromised devices anyway.

The point is that passkeys significantly reduce the attack surface.

Reply on news.ycombinator.com