Briefing / Primer / Identity
Are synced passkeys phishing-resistant?
Passkeys that sync across a user’s devices trade some control for usability. Here is what stays phishing-resistant, and what moves to the sync account.
[EDITORIAL: sample briefing drafted with AI assistance. Verify every claim against its sources before launch.]
BLUF Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.
High confidence
Based on the NIST SP 800-63B-4 text and the FIDO Alliance's statement on it.
Key points
- Phishing resistance comes from the passkey being bound to the site’s domain.
- NIST 800-63-4 accepts synced passkeys at AAL2.
- Security of the sync account (Apple, Google or a password manager) now matters.
Why passkeys resist phishing
A passkey is a key pair. The website stores the public key; the private key stays with the user. When the user signs in, the browser checks the site’s domain and only offers the passkey registered for that exact domain. A phishing page on a look-alike domain never receives a credential it could replay.[1]
What syncing changes
Synced passkeys are copied across the user’s devices through a provider such as Apple, Google or a password manager. That fixes the biggest usability problem of device-bound credentials, losing the device, but it moves part of the risk to the sync account. If an attacker takes over that account, they may be able to restore the user’s passkeys to a device they control.
How NIST treats them
NIST’s 800-63-4 guidelines accept synced passkeys at authentication assurance level 2 (AAL2), the level most consumer and banking logins target.[1][2] High-assurance use cases that require AAL3 still call for hardware-bound keys.
What to do if you run a login
- Offer passkeys as the default for returning users.
- Protect recovery: account recovery is where passkey deployments get attacked, so don’t fall back to SMS codes there.
- Keep a device-bound option for administrators and other high-risk users.
Questions
What is the difference between a synced and a device-bound passkey?
A synced passkey is backed up and copied across a user’s devices by a provider such as Apple, Google or a password manager. A device-bound passkey never leaves the hardware it was created on, such as a security key.
Can a phishing site trick a passkey?
No. The browser only offers a passkey to the domain it was registered for, so a look-alike domain gets nothing to relay.
Sources
Changelog
- Published.