Passkeys are a part of MFA.
It handles the randomized portion of this authorization. Its essential to have such part when implementing MFA. Its ment so that a passkey only works at 1 place, and 1 place only. Which means even if the connection is hijacked, they cannot extend the scope.
However, in regular situations passkeys are only usefull during authorization (you even authorize the login), but are not foolproof when the authorization isnt required. Usualy once logged in, these are never checked.
Everything with browsers relies on session cookies, usualy combined with an IP. For a compromised device this is trivial to catch/mimic. And you can do a lot of actions with these. Passkeys wont help if they arent requested.
And you cannot expect people to use a passkey constantly. And thats where the internet is vulnerable.
This is why good encryption repeatedly alters the key to communicate with, as this behaves a bit more like a passkey then (it doesnt prevent decryption, but it does prevent authorization if you dont have the latest key).
And yes, CSRF is one of these methods, but its not the only one, and its still ineffective when the device is compromised.
MFA says multiple, without any number, because its ment to contain as many as possible. And this includes:
- Something you know (password, token, or anything basic that requires to be repeated as identifier)
- Something you have (You dont want anything on a single device, you need something disconnected to perform the 2nd âpasswordâ like check)
- Something that identifies the action (If actions are anonymous, you might cause someone to hijack the sent key and use it somewhere else. So the verification must only work on the target. passkeys are very efficient here)
If any of these is missing, MFA breaks. Its also worth to note: there is no biometrics here. And this is because while its now hard to crack, its a hijackable feature that might be spoofable, and therefor will only work like a password. And without alterations being possible, its a weakness in MFA, because once known, its permanent. A password can be changed, a fingerprint cant.
A lot of tools are made to help at this. This is why your phone can use biometrics instead of a password. Websites use CSRF to identify the action. Codes are sent to mail to try to cover the âsomething you haveâ (which these days is deemed weak because its usualy the same device).
But in short, stating passkeys as safe is giving false hope.
You can still do a lot of damage without needing these, because social engineering can often be done without these. All it takes is 1 DM to an admin, as a moderator, to potentialy mislead someone. The moderator might have logged in once, using a passkey, but after the login, on a compromised device, you essentialy give the hacker a huge amount of options.
Passkeys are just a layer within MFA. And yes, in critical situations, MFA is usualy not enough.
Most companies for critical things rely on Multi-person-authorization instead. No one can take a step alone, someone always need to authorize it a 2nd time. And even here, it has proven to still often fail.
