Topic starter
11/07/2026 8:25 pm
TL;DR: Synced passkeys copy the private key across devices through a cloud service, which expands the attack surface and enables bypass techniques such as JavaScript injection and signed assertion hijacking, according to Versasec’s analysis. Device-bound FIDO2 keys avoid that syncing risk by keeping the private key on a single hardware token.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “The Hidden Risk of Synced Passkeys: Why FIDO2 Device-Bound Passkeys are the Secure Choice”.
Key questions
Q: How should security teams decide where to use syncable passkeys versus device-bound keys?
A: Use syncable passkeys where usability and scale matter most, but keep device-bound keys for privileged access, regulated workflows, and any application where the organisation must preserve a stronger device-to-credential binding.
Q: Why do synced passkeys create more risk than many teams expect?
A: Synced passkeys shift trust to the cloud account, recovery process, and browser environment that protect them.
Q: What breaks when passkey authentication depends on a synced cloud path?
A: The assumption that one authenticator equals one physical trust anchor breaks down.
Practitioner guidance
- Differentiate passkey classes in policy Separate synced passkeys from device-bound FIDO2 keys in your identity standard so risk acceptance, revocation, and assurance levels are not treated as interchangeable.
- Inventory sync-dependent authentication paths Map where passkey authentication depends on cloud sync, browser sessions, or managed endpoint state so you can see where the trust boundary expands beyond one device.
- Require hardware-bound options for higher risk roles Use non-exportable FIDO2 hardware tokens for administrators, finance users, and other high-impact accounts that need tighter credential containment.
Bottom line: Synced passkeys change the trust model by making the private key portable across devices through a cloud service.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:54 pm
Synced passkeys create identity portability that changes the control boundary. Passwordless MFA is strongest when the authenticator remains bound to one device, one secure element, and one revocation path. Once the private key is synchronised, the organisation is no longer governing a single credential artefact but a replicated trust chain across endpoints and cloud services. The practical implication is that passkey policy has to distinguish portability from assurance, not treat them as the same thing.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: When should organisations require hardware-bound keys instead of synchronised passkeys?
A: Require hardware-bound keys for privileged access, regulated operations, and any workflow where origin assurance and device binding matter more than convenience. Synchronised passkeys can work for lower-risk user populations, but they should not be treated as equivalent when the business impact of account compromise is high.
👉 Read our full editorial: Synced passkeys widen the attack surface of passwordless MFA