Passkey: Why It Is Inherently Phishing-Resistant

This article has three layers:

1. Layer 1: The Intuition: Keys and locks, and why verification codes get stolen.
2. Layer 2: Real-World Use: Who is using them, real phishing attack data, and "re-verifying for sensitive operations."
3. Layer 3: Principles and engineering key points: Registration and login flows, origin binding, and signature counters.

Layer 1: The Intuition

1.1 Why Passwords Always Cause Trouble

Their common weakness is: What you know, you can also tell someone else. A phishing website looks exactly like the real one; you type it in, and it immediately forwards it to the real website in the background—the whole process takes less than a second.

1.2 Passkey: You Don't Need to "Know" Anything

A Passkey is more like a key that only turns in the correct lock:

• During registration, your phone or computer generates a key pair: the private key is locked inside the device's secure chip, and the public key is given to the website;
• During login, the website sends a random number, the device signs it with the private key, and the website verifies it using the public key;
• You only need to scan your fingerprint or face; there is nothing to input or leak.

The most critical point: Before signing, the browser writes the current website's domain into the content being signed. If you scan your fingerprint on examp1e.com (a fake website), the signature will state examp1e.com; if you take that signature to the real website example.com for verification, it will definitely fail.

Layer 2: Real-World Use

• Adoption: In 2022, Apple, Google, and Microsoft jointly announced support for passkeys. Now, iCloud Keychain and Google Password Manager can sync passkeys across devices. Major websites like GitHub, PayPal, and Amazon already support them.
• Effectiveness: After Google mandated the use of hardware security keys (the same FIDO technology) for all employees in 2017, they publicly stated that no further employee account takeovers via phishing have occurred.
• Cryptocurrency Scenarios: Exchanges and wallets are increasingly using passkeys for "secondary confirmation of sensitive operations," because phishing is the number one entry point for stealing coins.

2.1 Re-verifying for Sensitive Operations (step-up authentication)

After logging in once, a session may last for several days. If someone borrows your computer or a session cookie is stolen, they can act as you. Therefore, high-value operations (transfers, changing payout addresses, changing notification emails) should require a passkey again on the spot. Using a fingerprint during a bank transfer is an application of this concept.

Layer 3: Principles and Engineering

3.1 Registration

3.2 Authentication

The server sends a new random challenge. The content signed by the device is:

$$\text{sig} = \mathrm{Sign}_{sk}\big(\text{authenticatorData} \,\|\, \mathrm{SHA256}(\text{clientDataJSON})\big),$$

Where clientDataJSON contains challenge, origin (such as https://example.com), and the type; authenticatorData contains the hash of the rpId, the "User Present / User Verified" flag, and the signature counter. The signature algorithm is typically ECDSA on P-256 (see "Elliptic Curves").

The server must check:

3.3 Why Server Leaks Are No Longer a Threat

The server only stores the public key. If the database is stolen, the attacker gets a pile of public keys, which can neither be used to log in nor used for credential stuffing. This is fundamentally different from passwords (even salted hashes).

3.4 Engineering Pitfalls

• Recovery: What if you lose all your devices? The recovery process often becomes the new weak link; it must be paired with waiting periods and notifications (see "Cooling-off Period").
• Trust Boundary of Synced Passkeys: The security of synced passkeys depends on the security of the cloud account (Apple ID, Google Account). For extremely high-value accounts, you can require a device-bound hardware key.
• Do Not Fall Back to Weak Methods: If a passkey fails, allowing a fallback to SMS verification allows an attacker to simply make the passkey "fail."

Summary