“Maybe there’s only one passkey?”: Challenges Investigating and Remediating Adversarial Passkeys

Passkeys are being actively rolled out by hundreds of web services who market them as a promising passwordless authentication method. However, it remains unclear whether people understand how to manage passkeys as part of their broader account security management, particularly in the aftermath of account compromise. We conducted a qualitative lab-based study that explores how people investigate and remediate suspicious activity when passkeys are used as a vector for illicit account access on three popular, passkey-supporting services: Google, PayPal, and LinkedIn. We recruited 31 participants with diverse technical backgrounds and tasked them with: (1) investigating a potential incident of compromise involving passkeys and (2) taking steps needed to re-secure the account.

Participants struggled to manage passkeys within account security settings and on devices, even when supported by service-provided email notifications, account security interfaces (ASIs), and streamlined wizards. The design and content of notifications and ASIs were often confusing or unclear, while the service-provided wizards were incomplete or misleading. This resulted in participants missing key steps required to discover adversarial passkeys and fully secure the account to prevent continued adversarial access. We discuss design implications and opportunities for future work to improve passkey management tools in ways that better support people experiencing account compromise.