Executive Summary
Passwordless authentication is often presented as the end of account takeover. But to understand the real threat landscape, we need to examine how passwordless is actually deployed in the real world. Attackers do not break protocols in theory. They target the most common implementations, the places where usability, scale and architecture intersect.
Focusing on one of those common...
The narrative presents Google’s passkey implementation as a sophisticated hybrid model, blending hardware-backed security with cloud synchronization to address the limitations of traditional passwordless authentication. The strongest version of this argument acknowledges the innovation in moving sensitive cryptographic operations to an isolated cloud environment while maintaining device-specific keys, which theoretically preserves security without sacrificing usability. However, the analysis als...