Distinguished Paper Award for Passkeys Security Research

A team of researchers from the Horst Görtz Institute for IT Security/the Cluster of Excellence CASA, the Bergische Universität Wuppertal, and Heilbronn University was honored at one of the world’s most prestigious conferences on IT security for their work on security vulnerabilities associated with the use of passkeys. The technology enables users to log in to websites without a password.

“Passkeys represent a significant step forward for IT security. Our analysis highlights where improvements are still needed,” explains Christian Mainka, professor of Robust, Secure and Privacy-Preserving Smart Systems at the University of Wuppertal and former CASA member. The study's lead author, HGI PhD Louis Jannett of the Chair of Network and Data Security of the Faculty of Computer Science at Ruhr University Bochum, elaborates: “Until now, there has been a lack of a comprehensive security analysis evaluating passkey-enabled websites. Our research not only fills this gap but also provides website developers and operators with tools to make future authentication technologies even more secure.”  

The USENIX Security Conference is a world-leading, vendor-neutral forum for cutting-edge international research in IT security. The Distinguished Paper Award presented there to the research team from Germany is regarded as one of the most prestigious honours in the field of IT security.

Why passkeys are so important

The award-winning paper examines the security of a modern authentication technology considered to be extremely secure: passkeys. Passkeys replace the traditional password with a digital key pair – one part remains securely stored on the user’s own device, such as a smartphone or laptop, whilst the other is stored by the website operator.

Given that billions of passwords continue to be stolen worldwide, this offers significant advantages for users. “Passkeys protect us from so-called phishing: unlike passwords, they cannot be stolen via fake websites. The web browser automatically recognises whether the website is genuine before releasing the digital key,” explains Mainka. This eliminates the risk posed by weak passwords, as well as the hassle of having to remember complex passwords; the login experience is significantly more convenient and secure for users.

Implementation still flawed

Through their study, the researchers sought to find out more about the current state of this relatively new technology, which has only been available to users for just over five years. In the process, they discovered that its implementation on many websites is still flawed. For instance, security tests were not implemented correctly, which could lead to real risks such as account takeover or users being locked out of their accounts. “The underlying technology remains secure. We’re finding the vulnerabilities on the websites that offer this login method. With the help of our findings, they can now improve the implementation of the technology in their systems,” reports Louis Jannett. The researchers also contacted the website operators concerned and drew their attention to the security vulnerabilities, some of which were serious.

For users, the findings do not change anything. At present, passkeys are usually offered only as an additional login option and are not yet proposed as a complete replacement for passwords. “Uncovering such security vulnerabilities is a standard research procedure that further improves new technologies and, so to speak, cures them of their teething problems. This also demonstrates just how important research is,” explains Prof. Mainka.

Methodology and results of the study

In their work, the researchers developed two key tools: Passkey-Radar is a database that provides the most comprehensive overview to date of Passkey-enabled websites and their prevalence since 2021. The Passkey-Attacker is a testing tool that enables the researchers to simulate 15 different attack scenarios and thereby specifically identify vulnerabilities in the application of the technology.

Analysis of a total of 103 websites tested reveals that none of the sites examined meets all the required security checks; more than half of the sites exhibit serious vulnerabilities, and in 18 cases, particularly critical vulnerabilities were found.

Publication

Jannett, L., Mayer, A., Westers, M., Mladenov, V., Mainka, C., & Schwenk, J. The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web.