A Framework for Abusability Analysis: The Case of Passkeys in Interpersonal Threat Models#

Alaa Daffalla et al., Cornell University / Cornell Tech; University of Wisconsin–Madison; New York University — Adjacent

• Why: The first analysis of how passkeys — the largest current push toward passwordless authentication — interact with interpersonal threat models (intimate partner violence, elder abuse), a threat class that's easy to overlook when passkey security is evaluated only against remote attackers.
• What: An abusability-analysis framework applied to 19 passkey-supporting services, finding abuse vectors including flawed implementations that let an abuser maintain ongoing illicit access with no recovery path for the victim, and vectors that let attackers lock victims out or gaslight them. (from abstract only)
• How: A general framework for identifying how new authentication features can be exploited by an adversary with routine physical device access and partial credential knowledge — applied specifically to passkey account-recovery and device-management flows. (from abstract only)
• Where applicable: General framework applicable beyond passkeys; the passkey-specific findings are directly relevant to anyone implementing or evaluating passkey account-recovery UX.