New research claiming passkeys can be stolen is pure nonsense

Skepticism is mounting around recent claims made by SquareX, a startup promoting security solutions, which asserts that passkeys can be compromised. This bold statement has raised eyebrows, especially considering the extensive security assurances provided by major tech giants like Apple, Google, and Microsoft, who have widely adopted passkeys as a robust form of authentication. The research, dubbed 'Passkeys Pwned,' was showcased at a recent Defcon event and suggests that a malicious browser extension, previously installed via social engineering tactics, can hijack the passkey creation process for services like Gmail and Microsoft 365. According to the findings, this extension creates a keypair linked to the legitimate domain, but under the control of the attacker, allowing unauthorized access to sensitive cloud applications. SquareX researchers argue that this discovery dismantles the notion that passkeys are invulnerable to theft. They emphasize that the ease of stealing passkeys is comparable to traditional credential theft, suggesting that the security perception around passkeys requires a reevaluation. Their research serves as a reminder that while passkeys offer advanced security features, they are still relatively new and may not have undergone the rigorous scrutiny that older technologies have faced over the years.