The Surprising Risks of Online Passkeys
A Cornell-led study co-authored by Assistant Professor Rosanna Bellini found that most people, including those with technical backgrounds, cannot identify or remove a rogue passkey planted by an abusive partner, and that changing a password offers no protection since a planted passkey stays active independently. The 31-participant study was presented at the 35th USENIX Security Symposium.
