The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web | USENIX

Researchers present PASSKEYS-RADAR, a dataset tracking passkey deployment on the web since 2021, alongside PASSKEYS-ATTACKER, a tool for manipulating WebAuthn messages to evaluate passkey security. Their analysis of 872 passkey-enabled websites revealed that nearly half of the tested sites were vulnerable to at least one high-CVSS attack, such as account takeover or passkey deletion. Additionally, the study found that websites frequently request authenticators to use deprecated cryptographic algorithms. Open article →