Do passkeys allow an attacker to gain account access by accessing a single device?

Question

Some companies such as Github suggest passkeys replace both passwords and 2FA:

passkeys satisfy both password and 2FA requirements

Github thus allows logging in with a passkey without any second factor, even if you have one enabled (like a authenticator app).

Consider a example scenario where a user's passkeys are stored in a password manager on a desktop computer, and the user also has a previously setup second factor for their online accounts. For simplicity, assume that the password manager storing the passkeys (and passwords) is not installed on the second factor, and is installed and permanently unlocked on the desktop computer.

My understanding is that when using passkeys, an attacker would only need to gain access to a single device (the desktop computer) either physically or via network to acquire the user's passkey vault, at which point the attacker could access all the user's accounts.

In contrast, 2FA with a mobile authenticator app or a hardware key (e.g., yubikey) would require the attacker to gain access two two devices, the desktop computer AND the second factor (e.g., phone, yubikey, etc.).

Is my understanding correct in this scenario, that passkeys reduce difficulty of targeted attacks vs. traditional 2FA by reducing number of devices that need to be accessed by the attacker?

Answer 1

Passkeys are inherently single-factor - they only require or prove possession of a private key, which the server has no capability to determine how you are storing or protecting - but the intended use case is that the private key is always hidden behind an additional authentication step required on every use, which makes them pseudo-two-factor. For example, on Windows (Windows Hello), MacOS, or Android - the platforms I've used passkeys on - the private keys are themselves stored in hardware security modules (requiring, at least in theory, "something you have") but won't (in theory) give software access to those keys without performing a platform (OS) authentication step, usually either a memorized secret ("something you know" e.g. PIN/swipe pattern/password/passphrase) or a biometric ("something you are" e.g. fingerprint/facial recognition/iris scan).

Of course, theory sounds like a lovely place, and I'd really like to live there some day. Here in reality, though, there's bypasses to all of these controls, plus software (such as password managers) that just straight up don't handle passkeys the way they're intended. Note that this isn't anything new to password managers; they've offered (although usually less pushily) to store "second" factors (usually TOTP keys and backup codes) alongside passwords for years now, sometimes with auto-fill for TOTP, and without requiring MFA for the password manager itself. All of which is to say, if you allow a password manager (or any other program) to store your passkey insecurely, of course it won't be as secure as if it's stored correctly!

With that said, I do think the common pattern of not even allowing users to require an actual second factor in combination with passkeys is really bad. They are, after all, ultimately only a single factor.

Answer 2

The short answer in this case is "yes"; one would only need to steal one device instead of two.

But be careful not to jump to erroneous conclusions from this fact.

You state the passkey authenticator is "permanently unlocked". That's a huge factor to consider that violates the whole purpose here. And it's this factor that makes this a reduced difficulty for an attacker. Not the fact that the passkey is on a single device and not split across two.

Why is the passkey storage vault "permanently unlocked"?

The whole point to passkeys is that, like the link you provided shows, the cryptographic keys are protected. Then to access those keys, you need to authenticate locally to that authenticator. If you remove that authentication step, then, yes, you yourself have reduced the protection of passkeys.

So, no passkeys don't reduce the difficulty of attacks. Stripping the protection from them does.