Passwordless Doesn’t Mean Risk-Free.

Security researchers are reminding everyone that passkeys aren't a silver bullet, especially on Windows. Signed authentication material and synced key stores can still be reached by local malware, meaning passwordless doesn't fully eliminate identity risk.

This is worth sitting with, because passkeys have been marketed, correctly in most respects, as the fix for a huge category of problems. No more reused passwords. No more phishing pages that trick someone into typing in a credential. That part is true and it is a real improvement. What this reminder points at is that passwordless was never the same thing as risk free.

Here is the distinction that matters. Passkeys are excellent at solving problems tied to how credentials get stolen remotely. A phishing site cannot trick someone into handing over a passkey the way it can trick someone into typing a password, and credential stuffing does not work against passkeys at all. What passkeys do not protect against is a compromised device. If malware is already running locally on a Windows machine with sufficient privileges, it may be able to reach the signed authentication material or the synced key store where passkeys live.

That means the security of a passkey is only as strong as the security of the device it lives on, which is a different threat model entirely from phishing.

Three things worth doing with this:

• Keep adopting passkeys, they remain a meaningful security improvement and this is not a reason to avoid them.

• Do not let passkey adoption become a reason to relax endpoint security. Malware protection, updates, and safe browsing habits matter just as much as before.

• Ask your IT provider or internal team exactly how passkeys are stored and synced in your environment, especially on Windows.

Do this today. Send that question to whoever manages your IT, and make sure your team hears passkeys described as a strong improvement, not an absolute guarantee.