Passkeys Replace Passwords, but Cookie Hijacking Remains a Critical Vulnerability
Traditional passwords are becoming obsolete as passkeys, developed by the FIDO Alliance, offer superior security by tying access to device hardware rather than server-stored credentials. While passkeys prevent database breaches and phishing, security experts warn that cookie hijacking remains a significant risk. Users are advised to shorten browser session durations and utilize password managers like NordPass or Proton Pass to manage these new authentication methods effectively.
Key points
- Passkeys use a public key stored by the service and a private key stored on the user's device or in a password manager, eliminating the risk of server-side data leaks.
- The FIDO Alliance developed passkeys, which resist phishing because they are unique to specific sites and cannot be guessed or shared.
- Security researcher Trevor Hilligoss warns that criminals can bypass passkeys by stealing validated browser cookies via malware, allowing them to emulate authenticated sessions.
- Users can mitigate cookie hijacking risks by adjusting privacy settings to choose the shortest available session duration for cookies, ensuring they expire quickly or upon browser closure.
- Microsoft is accelerating the shift by making new accounts password-less by default and removing password management from its Authenticator app, while retaining passkey storage.
Background
This development follows ongoing industry efforts to enhance digital security, as noted in previous coverage of AI-driven market shifts and infrastructure risks. While earlier reports focused on AI model integrity and power grid vulnerabilities, the current focus on passkeys highlights a parallel evolution in consumer data protection, moving away from static credentials toward dynamic, hardware-bound authentication.
Why it matters
As data breaches become near-constant, the transition to passkeys offers a fundamental shift in how online identity is verified, reducing the value of stolen data for criminals. However, the persistence of cookie-based vulnerabilities means that user vigilance regarding browser settings remains critical to maintaining security in the post-password era.
What to watch
Widespread adoption of passkeys is expected to continue, but website owners must address cookie hijacking vulnerabilities. Users should proactively update their browser privacy settings and ensure their password managers support passkey storage to stay protected against evolving threats.
Want the full story? Read the original reporting
Read on PCMag