We're now deep in an era of industrialized, AI-driven phishing. Attackers are using AI in every phase of the attack—from reconnaissance to the creation of phishing kits—allowing them to scale attacks with unprecedented speed. This is why it's disappointing to see an opinion circulating that advocates reverting to passwords and OTPs in place of phishing-resistant factors.
But here at Okta, we believe the evidence is clear: Passkeys (built on FIDO2/WebAuthn) prevent phishing attacks from leading to account takeovers.
How passkeys prevent phishing
Okta Threat Intelligence recently analyzed more than 6,000 social engineering incidents aimed at account takeover. We found that there would have been zero successful account takeover events amongst organizations that enforced passkeys as a factor across application sign-in and account management. Not a single one.
This chart shows the percentage of those account takeover attacks that would have been stopped by using a phishing-resistant factor. Mandatory user enrollment of a phishing resistant factor would have stopped 88%. That figure rises to 99.75% when applied to the app sign-in policy and then to ~100% when also applied to an account management policy.
Why? Because a passkey is cryptographically bound to the domain it was created for and can only be used with that domain. Users cannot be tricked into divulging their passkey to a fake website the way they can with weaker factors such as one-time passcodes (OTPs) or push notifications. This makes passkeys a phishing-resistant factor.
Despite the demonstrated efficacy, this opinion advocates for reverting to passwords and OTPs based on privacy concerns. The argument relates to a particular passkey creation scenario relevant to enterprise environments.
The concern centers on a property called attestation. Enterprises use attestation to collect critical information for security purposes when a new public key credential is generated. Enterprise attestation is a further enhancement on top of the baseline attestation that is specifically purchased by an enterprise for their domain that is not relevant for consumer devices. It does allow for a specific security key to be tracked when used against the corporate domain. The information collectively enables enterprises to prove a certain level of governance.
Attestation statements convey several pieces of information, including the authenticator model represented in the Authenticator Attestation GUID (aaguid) data field. This allows an organization to confirm that a passkey was created with the type of platform authenticator that is allowed by their policies. Additionally, some organizations may view passkeys that are not device bound to be a risk, so an attestation statement can confirm that the newly created passkey cannot be synced. None of this information allows tracking a user across different domains.
On the consumer side, it is not necessary to do attestation. Additionally, when the specification for passkeys was written, privacy concerns were addressed in several ways. The metadata around passkeys created with non-enterprise authenticators is randomized such that no one can be tracked. This is the status today. Basic attestation only returns a statement with non-identifiable information, preserving privacy. Consumers cannot be tracked with passkeys.
Why passkeys can't wait
The web is increasingly moving to passkeys as the threat landscape demands it. Our analysts are discovering at least one vibe-coded phishing kit per week, some of which, like the Work Panel vishing kit, we have publicly detailed. “Vishing” attacks, where callers ring targets to social engineer them, have proven effective and contribute to initial access and, eventually, data breaches. Malware steals both credential pairs and session tokens. This authentication material ends up in underground cybercriminal markets, where it is bought and sold in vast quantities to cybercriminals who use it for intrusions, data extortion/ransomware and investment, cryptocurrency, and interpersonal fraud schemes.
That’s why passkeys are more important today than ever to protect enterprise users, consumers, and organizations themselves. When implemented fully, passkeys help prevent account takeovers. In a customer identity context, requiring passkeys stops attacks such as credential stuffing, as threat actors do not have access to this factor. This reduces fraud, such as the theft of loyalty points from consumer accounts.
Privacy matters, but reverting to phishable passwords to solve an enterprise edge case is a dangerous trade-off. Account takeover can be devastating, and just one account takeover can have a snowball effect. The theft and re-use of credentials for someone’s email account may allow a threat actor to initiate accounts for social media, financial, and retail accounts connected to that address. Once the fraud starts, it’s a nightmare to unwind.
Fear, uncertainty, and doubt about passkeys is the trap. Don’t fall for it.
This content is for informational purposes only, does not constitute professional advice, and is provided without warranties or liability; please consult your own advisors for implementation decisions.
