A Framework for Abusability Analysis: The Case of Passkeys in Interpersonal Threat Models

This talk introduces an "abusability analysis framework" to evaluate technologies like passkeys under interpersonal threat models, such as intimate partner violence. An analysis of 19 services revealed critical implementation flaws, including irrevocable cloned passkeys and the failure of password resets to secure accounts, which can create persistent backdoors for abusers.

September 24, 2025 4 min read

The recent industry-wide push for passwordless authentication, or passkeys, aims to simplify and secure logins. While based on the robust FIDO2 standard, current security analyses have focused on traditional threat models like cybercriminals, neglecting the unique challenges of interpersonal threats found in contexts like intimate partner violence. In these scenarios, adversaries often have physical access to a victim’s devices and can compel the disclosure of PINs, creating qualitatively different security challenges.

A Framework for Abusability Analysis

To address this gap, a new six-step framework for conducting abusability testing on technology products was introduced. This structured process is designed to identify how features can be exploited in interpersonal threat models.

The framework consists of the following steps:

Identify the Threat Model: Assume an adversary who targets a specific individual and is part of their social circle.
Perform a Functionality Assessment: Conduct a focused survey of the system’s behavior from a user’s perspective, inventorying all functions related to the feature’s lifecycle (e.g., for passkeys: setup, authentication, export, revocation, and visibility).
Hypothesize Abuse Vectors: Brainstorm potential ways the technology could be misused within the identified threat model.
Design Step-Through Protocols: Create detailed, step-by-step guides that simulate the actions of both the victim and the abuser for each hypothesized vector.
Test Abuse Vectors: Execute the protocols on real-world systems.
Analyze and Report: The output is a detailed transcript of UI actions and documented abuse scenarios.

This framework was applied to analyze passkeys on 19 services across macOS, Windows, and Android, revealing seven distinct abuse vectors.

Key Abuse Vectors Discovered

The analysis surfaced several critical abuse vectors related to unauthorized access that stem from flawed implementations and incorrect user assumptions.

1. Passkey Cloning

An attacker with temporary physical access to an unlocked device can create a permanent, covert backdoor into a victim’s account.

Mechanism: The abuser uses built-in OS features like Apple’s AirDrop or Google’s account sync to export or “clone” a passkey from the victim’s device to their own.
Impact: This creates an independent, valid credential on the attacker’s device. In the most severe case found on TikTok, this cloned passkey cannot be revoked. Even if the victim resets their password and creates a new passkey, the attacker’s cloned key remains active, granting them ongoing, undetectable access. On other services, logins from cloned passkeys were often difficult or impossible to detect in account activity logs.

2. Adversarial Passkeys

An attacker can convert temporary account access (e.g., from a known password) into persistent, password-independent access.

Mechanism: The abuser logs into the victim’s account and registers their own device as a new passkey.
Impact: The study found that six services did not require any form of re-authentication to add a new passkey. Furthermore, four services sent no email notification to the user about this critical security event. This allows an attacker to maintain access even after the victim changes their password. On eBay, there was no user interface to even view registered passkeys, making the adversarial passkey invisible.

3. Adversarial Biometrics

A known threat that is significantly amplified by passkeys, where adding a fingerprint to a device grants access to all passkey-protected accounts.

Mechanism: An attacker with knowledge of the device PIN adds their own biometric data (e.g., a fingerprint) to the victim’s device.
Impact: This single action compromises every account on that device that uses passkeys for authentication. The analysis found that operating systems fail to adequately protect users by:
- Not notifying the user when a new biometric is added.
- Using generic labels like “Finger 1, Finger 2” (macOS, Android), which makes it difficult for a user to identify an unauthorized biometric.
- Providing no visibility at all into configured fingerprints (Windows).

Systemic Implementation Failures

Beyond specific vectors, the analysis revealed systemic issues in how passkeys are managed:

Password Reset is Ineffective: A critical finding was that resetting an account’s password does not revoke existing passkeys on almost all services tested (eBay was the only exception). This violates users’ mental models of security, as they believe a password reset will secure their account by invalidating all previous credentials.
Poor Session Management: On services like GitHub and LinkedIn, revoking a passkey did not terminate the active session associated with it within a 16-minute testing window, allowing an attacker to remain logged in.
Lack of Visibility and Control: Users often lack clear interfaces to see how many passkeys are active on their account and to manage them effectively.

These findings were disclosed to the affected companies and the FIDO Alliance. While some companies dismissed the issues by claiming local device access was “out of scope,” the research highlights a critical need to design passkey management tools with a focus on at-risk users and abuse prevention.