Drawing the Right Conclusions from Independent Security Research

In a recently published academic paper accepted at the 35th USENIX Security Symposium, researchers from Ruhr University Bochum, Heilbronn University of Applied Sciences, and the University of Wuppertal shared the results of evaluating 103 live passkey deployments. Titled ‘The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web’, the research highlights several implementation issues that are well worth bringing to the attention of anyone implementing passkey-based authentication.

Independent security research like this plays a vital role in strengthening the Internet’s security infrastructure, and we encourage everyone to read the paper. In particular, research that rigorously tests real-world deployments of passkeys as they are increasingly adopted around the world are especially helpful in identifying weaknesses, improving implementation quality, and ultimately benefiting users. This is an area that isn’t covered by industry certifications like what FIDO provides, as it is typically handled through other mechanisms like pentesting or security assessments that are highly dependent on the deployment’s broader context. The FIDO Alliance welcomes this kind of scrutiny because it contributes to a stronger and more resilient authentication ecosystem.

Our initial assessment is that the research is quite credible, and highlights several implementation issues that are worth paying attention to in your own deployments, such as skipping or improperly verifying assertion signatures, not validating origin correctly, or ignoring signature counters. The research also reinforces that the FIDO2 specifications and the cryptography it is built on are sound.

However, as I pointed out in a past post about the conversation around passkey security, it is important to look past the attention-grabbing headlines and understand the real takeaways from security analysis such as this. Keep that in mind when someone says that this paper demonstrated that none of the tested deployments passed “all security checks mandated by the standard”. That’s because it is important to distinguish between implementation weaknesses and weaknesses in the standards themselves.

The Difference Between Standards and Implementations

Let’s start with something the paper makes pretty clear: the research does not demonstrate a weakness in passkeys, WebAuthn, or the underlying FIDO authentication architecture. Instead, it demonstrates something that security professionals have long understood, which is that even the strongest security standards must be implemented correctly to deliver their intended protections.

That’s an important point, and matters for the purposes of understanding this research (and similar ones emerging). A flaw in an implementation should not be interpreted as a flaw in the protocol any more than a software bug implies that the underlying cryptographic algorithm is broken.

Interpreting the “0 of 103” Result

Where we believe the paper overstates its conclusions is in its headline-grabbing claim that none of the 103 deployments passed “all security checks mandated by the standard”, especially since they actually tried to test 208 independently implemented sites out of 386 confirmed passkey-enabled websites.

Our assessment is that the researchers combined several different categories of checks into a single aggregate score, including:

• Mandatory protocol verification requirements
• RP-specific policy decisions
• Implementation guidance and best practices
• Operational and deployment considerations
• Lower-impact conformance and robustness checks

These categories are not equivalent from either a standards or security perspective, which is an important aspect of any .

As a result, the “0 of 103” conclusion should be interpreted as these implementations failing the authors’ comprehensive test suite — which very intentionally establishes a very high bar somewhat divorced from each deployments own threat model — rather than evidence that every relying party violated mandatory WebAuthn or FIDO requirements.

Put differently, the aggregate result does not preserve the distinction between mandatory requirements and optional or policy-dependent behaviors. It therefore should not be interpreted as meaning that every deployment failed at least one mandatory security requirement.

What the Research Does Tell Us

The research paper does reinforce an important industry reality: secure authentication depends on both strong, well-designed standards and the correct and secure implementations of those standards.

The FIDO ecosystem has invested heavily in developing open, rigorously reviewed specifications and robust certification programs. That work provides the foundation for phishing-resistant authentication. At the same time, every deployment includes application logic, server integration, account management, and operational decisions that extend beyond the protocol itself. Those layers also deserve careful security review through independent security assessments and research such as this. These findings justify better negative testing of production deployments, and demonstrate why it’s important to use a well-maintained WebAuthn library or service and then test the account, session, and credential-record integration separately.

Moving the Ecosystem Forward

Rather than diminishing confidence in passkeys, this research provides an opportunity for the industry to continue raising the bar. Within the FIDO Alliance, we will continue to examine the findings from all security research like those shared in this paper, and evaluate whether additional implementation guidance, testing methodologies, or certification enhancements could further strengthen the ecosystem. That is how security standards evolve — through rigorous analysis, learning from implementation experience, and continuously improving guidance for developers and relying parties.

The takeaway should therefore be one of confidence, not concern. The paper identifies opportunities to improve implementations, not evidence that passkeys or the WebAuthn/FIDO standards have failed. As passkey adoption continues to accelerate across consumers, enterprises, and governments, this collaborative process of independent research, standards development, certification, and implementation improvement is exactly what the FIDO Alliance is looking to foster, so that we can continue to make the ecosystem stronger.