Do mandatory passkeys bypass traditional two-factor authentication?
Mandatory passkeys can completely bypass traditional two-factor authentication with a single button click if a computer is left unlocked. This leaves systems vulnerable to internal actors and agents that can inflict damage regardless of scoped access or marketing claims about sandboxing.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
Do mandatory passkeys bypass traditional two-factor authentication?
- 1patching exploits as soon as possibleDid this help you?
- 2utilizing network segmentationDid this help you?
- 3moving to strong encryption 2FA, and current best practice password policiesDid this help you?
- 4planning for failure as a foregone conclusion and planning for recoveryDid this help you?
- 5Using hardware passkeys like Yubico or Token2 that require a PINDid this help you?
- 6Falling back to traditional security methods like password reset by email where supportedDid this help you?
- 7Storing passkeys in password managers that require biometrics or a PINDid this help you?
- 8using device filters instead of device compliance rulesDid this help you?
- 9setting up separate browser profiles for admin accountsDid this help you?
- 10implementing Privileged Identity Management (PIM) with timed activationDid this help you?
- 11storing break-glass account passwords offline in physical safesDid this help you?
- 12Ask what business problem they are trying to solve and offer a secure alternative like an email export or delegate access.Did this help you?
- 13Explain the extensive risks (like giving access to all connected files and systems) to deter them.Did this help you?
- 14Make the client reset and share the password themselves, then immediately force a reset, revoke sessions, and check for forwarding rules when the third party is done.Did this help you?
- 15Create a temporary account with delegate access for the third party.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“Client asking us to give his M365 email password so he can share it with his solicitor!!!”source ↗
“Whilst we can reset his password , we want to cover ourselves, and he can do whatever he wants to. Is there a waiver template anyone could share.”source ↗
“I would not put my name on a waiver for this one. A signed waiver does not really protect you if you hand over a credential you know should not be shared, and it still leaves you in the middle if anything goes sideways in that mailbox.”source ↗
“However, when I login it complains that I'm not logged in to the GA-account in Edge since I'm logged in as my regular user.”source ↗
“I have not seen the attack I am worried about. agent poisoning at the LLM level. The attacker will already be in the building and even if access is scoped correctly damage will occur.”source ↗
“how did it find credentials if it was sandboxed? Or is sandboxed just a general term to make CEO's and investors think the latest Frankenstein just broke its chains”source ↗
“With how frequently there are bugs for Intune Compliance detection (currently waiting for the antivirus check to work correctly again), I use a device filter instead filtered for AAD Join rather than rely on a device being marked compliant.”source ↗
“A bunch of tools we use are rolling out passkeys as mandatory instead of password/2FA requirement.”source ↗
“A user leaves their computer unlocked. A bad actor enters the user's email address on their computer. They click the one button to use the passkey. 2FA never played a factor in that login, it's barely even one factor...”source ↗
Where this came up
People with this problem also raised
- 6Locked out of new network switches because the consultant left
- 3How do you manage accounts and passwords that don't use SSO?
- 2Why does accounting software force logins for every company file?
- 8How to clean up a hacked website and fix malware
- 3Why won't senior staff let junior admins do anything?
- 5Can you still access financial records after canceling a subscription?