What are the security pros and cons of setting up passkeys for Gmail logins?

Question

Today while signing on to Gmail with my iPad, I was prompted:

With passkeys you can now use your fingerprint, face, or screen lock to verify it’s really you.

I was wondering what the security pros and cons of setting up these passkeys?

Answer 1

The benefit is that passkeys have a higher entropy than typical user-chosen passwords and are – by themselves – immune to brute-force attacks. They also never have to be transmitted as plaintext, since authentication uses a challenge-response protocol based on public-key cryptography. Additionally, not having to enter a password prevents phishing attacks.

On the other hand, gaining access to your phone or your iCloud account can allow an attacker to obtain all passkeys at once. For example, if you have a weak passcode, or if the attacker manages to bypass the biometric protection (which has happened in the past), then there's no longer any protection for the accounts. In contrast to passkeys, you can compartmentalize passwords (e.g., with different databases in your password manager) or choose not to store them at all. This means even a compromised phone or iCloud account doesn't necessarily mean that the attacker can compromise all accounts as well.

Answer 2

Security pros:

1. Passkeys are resistant to:
   1. Phishing - you hand over your password to a bogus site which looks like Google. Passkeys prevent phishing by ensuring the website in the browsers address bar matches the website for which the passkey was created.
   2. Credential stuffing - you use your Google email/password on another site, which is hacked. The attacker can use your credentials to log into Google.
   3. Brute force attacks e.g. dictionary or rainbow table attacks.
   4. Replay attacks - the private part of a passkey is never shared with a website (even a legitimate one)
2. Passkeys can enforce user verification - requiring you to re-authenticate (typically using facial or fingerprint recognition) when using a passkey.
3. Attestation allows a website to restrict the type of device(s) that can be used to store the passkey. For example if a major vulnerability is found in a particular device (see below) the website developers to prevent users from using that device. Alternatively they could whitelist particular devices.

Security cons:

1. Similar to a password manager, the passkey is managed by your device so it's possible (although unlikely) that your device is compromised by a virus or malware which then steals your passkeys.

2. The website you're signing into may tell the browser to skip "user verification" in which case you just need to click a button to confirm the login. If your device is unlocked, anyone with access to it could use the passkey to sign in to a site/app.

3. The technology is still relatively new. As with all new features there's a greater risk of security vulnerabilities. So whilst passkeys should be more secure than passwords, a bug could introduce vulnerabilities.