AINEWS
A Cornell study finds the device bound login credentials, designed to replace passwords, can be installed by a partner in minutes and survive a password reset.
An abusive partner with five minutes alone at an unlocked laptop can register a passkey on Google, PayPal, or LinkedIn, and that login will keep working after the victim changes the password. The new credential, designed to replace passwords and end phishing, survives the most common defense survivors reach for first.
A peer-reviewed Cornell user study presented this week at the 35th USENIX Security Symposium in Baltimore found that the overwhelming majority of participants, including self-described technical users, could not identify and remove the adversarial passkey without direct expert help. The study, "Maybe there's only one passkey?" by Daffalla, Myers, Bellini, Ristenpart, and Dell, isolates a gap in the WebAuthn design that the industry has spent two years rolling out as the safest login a consumer can use.
A passkey is a device-bound login credential. The phone or laptop generates a public-private key pair, the private key never leaves the device, and the user proves who they are with a fingerprint, a face scan, or a PIN. A phishing site cannot steal it, because the credential is bound to a specific site's domain. No password is typed. No secret is replayed. Google, Apple, Microsoft, and the FIDO Alliance have built the passkey rollout around that anti-phishing property, and on its own terms, it works.
The threat model passkeys were designed for is the remote attacker: credential stuffing, phishing kits, vishing scripts. A coercive partner in the same room is not in that model.
To register a passkey, the user needs to be logged in and to confirm with the device's biometric or PIN. An abusive partner with brief access to an unlocked device can complete both steps. The passkey lives in the device's associated cloud storage or a hardware security key, and the victim's account has no way to know that a second device is now allowed in. The passkey registration and the password authenticator are independent in WebAuthn, so changing the password does not remove the rogue credential. The backdoor persists.
The Cornell Chronicle covered the study on August 13, 2026, the day after the Baltimore symposium opened. The same research group published the "A Framework for Abusability Analysis" paper at the 34th USENIX Security Symposium in 2025, which is where they first named the lens: technology can be perfectly secure against the threat it was designed for and still be unsafe for the person using it.
Roughly 10 to 12 million Americans experience intimate partner violence each year, and 97 percent of US domestic-violence programs report technology abuse from partners, according to the National Network to End Domestic Violence's Safety Net Project, as reported by the Cornell Chronicle. That is the scale of the constituency the passkey rollout has not accounted for.
A password reset is the first move an account-takeover guide tells a survivor to make, and it is the move the passkey model renders incomplete. The study's participants could not find the rogue credential in their account settings, and most of the time, the setting was not surfaced in a way a non-expert would look. Recovery support for survivors is built around credential resets, password changes, and contacting each relying party. None of those steps close a passkey that was never the victim's.
The anti-phishing primitive is doing exactly what it was built to do, and the standard for replacing passwords should stay where it is. The missing primitives are on the other side of the same login: per-account registration audit logs that the account holder can see, named and labeled credentials so a survivor can recognize a device that is not theirs, opt-in expiry of all registered passkeys when the password is reset, and partner-aware account recovery flows built in consultation with IPV service organizations.
The FIDO Alliance, the W3C, and the three platform vendors have the work in front of them. The cryptographic credential is the right primitive. The usability and recovery primitives an entire class of users needs are not in the same spec yet. They can be added without weakening the anti-phishing win, and the Cornell study has now made the cost of leaving them out measurable.