#passkeys

4 articles

Android can now move your passkeys between password managers. Whether it asks for your fingerprint is up to the app you leave

2026-09-15Gadgets

Google has switched on direct transfers of passwords and passkeys between password managers on Android, built on the FIDO Credential Exchange Format and live in Google Password Manager, 1Password, Bitwarden and Dashlane. Apple describes its version as secured by Face ID. Android's developer guide leaves the biometric prompt to the exporting app, and its sample code marks it optional.

The call is about your passkey. The break-in uses routes a passkey alone does not close

2026-09-15Security

Microsoft says extortion groups tied to ShinyHunters and Helix are phoning staff about urgent passkey or single sign-on updates, then steering them into relayed sign-ins or device-code approvals. Once in, they register an MFA method of their own, map the tenant through Microsoft Graph and take files at under 1,000 an hour to stay unremarkable.

The phishing kit adds its own passkey — so resetting the password does not remove the attacker

2026-08-22Security

Abnormal found iAuthFlow V2 selling for $10,000 on Russian-language forums. During the phishing flow it silently registers an attacker-controlled passkey on the victim's account. Passkeys are independent of the password, so the standard remediation — reset, revoke sessions — leaves the intruder logged in.

Three separate teams found ways around passkeys — and one of them recovers the private key

2026-08-12Security

Black Hat and the weeks around it produced three unrelated results against phishing-resistant authentication: replayable signatures in Windows event logs, a master key pulled from Chrome's memory, and Windows Hello keys used without a PIN prompt.