> Markdown version of [/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls

Are passkeys truly phishing-resistant? Discover how flawed configurations undermine WebAuthn and learn to integrate secure identity providers without building everything from scratch.

- **Speakers:** [Martina Kraus](https://www.wearedevelopers.com/@martinakraus)
- **Event:** World Congress 2026 Europe
- **Published:** July 9, 2026
- **Duration:** 31:16
- **URL:** https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls

## Summary

While traditional multi-factor authentication and time-based OTPs fail to prevent phishing due to live proxy attacks that can intercept session cookies, passkeys solve this vulnerability structurally. By leveraging the WebAuthn API, passkeys authenticate users by cryptographically binding a public-private key pair specifically to an origin domain (the Relying Party ID). Because the server only stores the public key and utilizes one-time cryptographic challenges, replay attacks and credential stuffing are aggressively mitigated without relying on a shared server-side secret.

Moving past theoretical security, integrating passkeys correctly requires disciplined configuration to maintain true phishing resistance. Using Keycloak as an identity provider, software builds can configure passwordless authentication policies that cleanly transition users from legacy passwords. Key implementation choices include defining allowed authenticator types—balancing between cross-platform authenticators like YubiKeys and hardware-bound platform options like TPMs or secure enclaves—and establishing account recovery mechanisms via verifiable magic links rather than secondary backup passkeys.

A flawed configuration can silently undermine phishing resistance. Engineering teams must tightly scope the Relying Party ID to mitigate subdomain takeover attacks and explicitly enforce user verification (like biometrics) to block proximity exploits, such as unauthorized users triggering a Bluetooth passkey from an unlocked device. Validating authenticator attestation by continually querying the FIDO Metadata Service protects against insecure or tampered authenticators. Ultimately, teams are cautioned to "do never implement this on your own." Instead, they should rely on robust Identity-as-a-Service integrations and intentionally phase out fallback passwords, eliminating the application's weakest link.

**Keywords:** passkey authentication, phishing-resistant mfa, webauthn api, fido2 implementation, keycloak identity provider, relying party id, authenticator attestation, fido metadata service, time-based otp vulnerabilities, hardware-bound passkeys, cross-platform authenticators, user verification protocols, subdomain takeover prevention, passwordless account recovery, magic link authentication, identity-as-a-service

## Chapters

1. **Why traditional multi-factor authentication fails against modern phishing** (00:45) — Proxy-based attacks can easily intercept time-based one-time passwords to bypass traditional multi-factor authentication.
1. **How passkey architecture provides built-in phishing resistance** (04:56) — Passkeys tie credentials directly to origin domains and utilize cryptographic signatures to eliminate interceptable secrets.
1. **Enabling and managing passkey authentication using Keycloak domains** (08:31) — Developers can register and handle hardware-bound or cross-platform passkeys directly through identity providers like Keycloak.
1. **Configuring the relying party identifier to prevent subdomain takeovers** (13:55) — Restricting the authentication domain prevents attackers from exploiting dangling subdomains to compromise broad passkey scopes.
1. **Enforcing local user verification to prevent physical proximity attacks** (16:46) — Requiring strict biometric unlock steps blocks unauthorized authentication attempts from a nearby connected mobile device.
1. **Evaluating authenticator attestation and utilizing the metadata service** (18:45) — Verifying manufacturer certificates against a global database ensures that only trusted authenticator models are accepted.
1. **Phasing out passwords and managing passkey account recovery** (24:34) — Transitioning users entirely away from passwords requires secure fallback mechanisms like magic links for lost hardware devices.
1. **Key integration takeaways and leveraging managed authentication services** (26:54) — Utilizing established identity providers prevents critical implementation flaws while supporting modern cryptographic standards and hardware constraints.

## Related Moments

- [Defending against phishing with hardware passkeys](https://www.wearedevelopers.com/videos/100322-mfa-game-over-watch-your-protection-collapse-live) (from "MFA? Game over! Watch your protection collapse – live")
- [Platform integration and synchronization using passkeys](https://www.wearedevelopers.com/videos/810-passwordless-future-webauthn-and-passkeys-in-practice) (from "Passwordless future: WebAuthn and Passkeys in practice")
- [Hardware keys and mitigating persistent password vulnerabilities](https://www.wearedevelopers.com/videos/1331-wearedevelopers-live-chrome-for-sale-comet-the-upcoming-perplexity-browser-stealing-and-leaking) (from "WeAreDevelopers LIVE - Chrome for Sale? Comet - the upcoming perplexity browser Stealing and leaking")
- [Shifting organizational security toward phishing-resistant authentication standards](https://www.wearedevelopers.com/videos/100322-mfa-game-over-watch-your-protection-collapse-live) (from "MFA? Game over! Watch your protection collapse – live")
- [Securing application access with WebAuthn and physical FIDO keys](https://www.wearedevelopers.com/videos/714-going-beyond-passwords-the-future-of-user-authentication) (from "Going Beyond Passwords: The Future of User Authentication")
- [Improving usability around secure private key custody](https://www.wearedevelopers.com/videos/999-why-you-should-care-about-the-decentralized-computing-movement) (from "Why You Should Care About the Decentralized Computing Movement")

## Related Articles

- [The top 200 passwords of 2024 can be cracked in less than a second](https://www.wearedevelopers.com/magazine/502-the-top-200-passwords-of-2024-can-be-cracked-in-less-than-a-second)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)

## Related Jobs

- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Penetration Tester / Red team Specialist](https://www.wearedevelopers.com/jobs/ext/293774-penetration-tester-red-team-specialist) at **Raiffeisen Bank International AG**
- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Cyber Security Architect](https://www.wearedevelopers.com/jobs/ext/1210090-cyber-security-architect) at **BWI GmbH**