What if the very tools designed to protect us online are quietly enabling new forms of digital control? That’s the unsettling reality emerging from recent research on passkeys—a technology hailed as the future of secure authentication. While passkeys promise to eliminate the chaos of passwords, their design harbors a critical blind spot: they can become weapons in the hands of abusers. This isn’t just a technical flaw; it’s a cultural failure to anticipate how technology intersects with human vulnerability.
Let’s unpack this. Passkeys use cryptographic keys stored on devices to log into accounts, bypassing the need for passwords. Sounds brilliant, right? But here’s the catch: if an abuser gains physical access to a victim’s device, they can install their own passkey. This means they can silently log into the victim’s accounts—email, social media, financial platforms—without ever needing the password. The Cornell study on this issue is a wake-up call. Researchers simulated scenarios where participants’ accounts were compromised, and the results were staggering. Most people, even those claiming tech proficiency, couldn’t detect the intrusion or fix it. One participant thought their iCloud Keychain showed a single passkey for two devices, not realizing an attacker had planted a second one. This isn’t just about ignorance; it’s about design failures that make security invisible to the average user.
What makes this particularly fascinating is how it exposes a deeper tension in tech development. We’ve long focused on making systems ‘secure,’ but rarely on making them understandable. The study highlights a critical gap: passkey interfaces are opaque. Users don’t know how to check for unauthorized keys, change passwords, or log out from other devices. This is especially dangerous for survivors of intimate partner abuse, who often face coercion or surveillance. Imagine trying to escape an abusive relationship, only to find your digital life still under someone else’s control. The psychological toll of that is immeasurable. It’s not just about privacy—it’s about autonomy.
I’ve always argued that security tools must be as intuitive as they are robust. Yet here we are, relying on systems that require users to navigate labyrinthine menus to protect themselves. The researchers point out that even clinicians working with abuse survivors struggled with the passkey interfaces. That’s not a minor issue—it’s a systemic one. If experts can’t grasp the basics, how can we expect the general public to? This raises a deeper question: Are we designing technology for users, or for engineers?
The solution isn’t just about better instructions. It’s about reimagining how we build these systems. For instance, why can’t passkey interfaces automatically alert users to multiple keys on their account? Why can’t they provide step-by-step guidance to remove unauthorized access? The study’s authors argue that services like Google, LinkedIn, and PayPal need to prioritize ‘account diagnostics’—features that let users see who has access to their accounts and how to revoke it. This isn’t a stretch; it’s a necessity. If we’re serious about digital safety, we must treat account security as a human rights issue, not just a technical one.
Looking ahead, this research feels like a harbinger of a larger trend. As we move toward passwordless authentication, we must also confront the unintended consequences of these systems. The Clinic to End Tech Abuse, which funded this work, is already pushing for policies that hold tech companies accountable. But change won’t come from regulations alone. It will require a cultural shift in how we think about security. We need interfaces that don’t just work but explain themselves. We need systems that recognize the difference between a user who’s curious and one who’s being forced to comply. And most importantly, we need to stop treating digital security as an afterthought. The stakes are too high.
In the end, this isn’t just about passkeys. It’s about power. Technology amplifies the dynamics of control in relationships, for better or worse. If we fail to design systems that protect the most vulnerable, we’re not just failing at engineering—we’re failing at humanity.
