Passkeys can be, and have been, stolen and hijacked. They make it more difficult for scammers and hackers to get into your accounts, but not impossible. How many phishing emails have you personally fallen for that this is your #1 concern over the fragility and complexity of passkeys?

▲

jt2190 2 hours ago | parent | next [-]

Can you provide details on this attack?

Typically the user gives a website their public passkey, which does not need to be kept secret since it’s public. If the website is hacked the attackers only get information that is already public.

You seem to be talking about a scenario where a user’s private keychain on their computer is compromised and the attacker is able to access other systems from that same machine without the user’s knowledge. (Note that the keychain data is itself encrypted so can’t be used from a different computer.)

▲

MBCook 2 hours ago | parent | prev | next [-]

As far as I know, it has never happened. I know there was a presentation or two on bugs in individual password managers.

But that is not a flaw in passkeys. And there have been bugs in password managers that expose standard passwords as well.

	▲	autoexec an hour ago \| parent [-]
		> But that is not a flaw in passkeys. By that reasoning passwords are 100% secure too, it's the human's fault when they fall for phishing sites! Passkeys depend on humans, password managers, devices, certificate authorities, browsers, and operating systems. That's not even including the implementation itself (https://www.esentire.com/blog/securing-passkeys-thwarting-au...) All of this means that even when you're using a passkey an attacker could still break into your accounts. Passkeys can make it harder for them, but it can make it harder for you to get access to your accounts too. For me, I don't think the risk of phishing is worth the trouble passkeys would cause me.

▲

whyagaindavid 2 hours ago | parent | prev [-]

> Passkeys can be, and have been, stolen and hijacked.

Proof needed.

> How many phishing emails h

The point is the average Joe will not be phished - especially important stuff - like email or eBay or bank. That is the reason for passkey.

Yes, many people in HN can avoid scammers.

	▲	autoexec 2 hours ago \| parent [-]
		Feel free to google for more: https://www.forbes.com/sites/zakdoffman/2025/08/28/yes-your-... https://www.howtogeek.com/passkeys-were-supposed-to-be-more-... https://www.malwarebytes.com/blog/news/2026/08/googles-synch... https://cybernews.com/security/google-passkeys-vulnerability... https://cybersecuritynews.com/passkeys-via-aitm-phishing-att... https://www.zdnet.com/article/your-passkeys-could-be-vulnera...