Passwordless is safer—until the browser is already trusted

Passkeys are a real improvement against phishing and password reuse, but “passwordless” can make the unlocked device the credential. A borrowed laptop with my browser profile, a stolen but unlocked phone, malware on my personal machine, or someone briefly using an already-unlocked browser may not need to phish me at all. They may inherit synced credentials or act through an existing session cookie while it remains valid.

That is a different threat from breaking the passkey, and it is easy to overlook. I’m also uneasy when convenience means syncing identity and browsing-related data by default, especially when the service gives me little visibility into what follows me across devices.

I favor a plain session inventory: service, device, browser, approximate last activity, and token or credential type, with one-click revocation and minimal telemetry—no unnecessary location history. What real-world examples have you seen, and what does your preferred authentication setup actually protect against?

Strongly agree on separating phishing resistance from session security. A passkey can stop a fake login page while doing nothing about malware operating inside an authenticated user session. The inventory should also distinguish background sync from deliberate activity, or its timestamps will create false alarms.

I’d call the unlocked browser the primary problem, not passwordless auth. Passwords stored in that same profile are hardly a safer fallback. The useful control is reauthentication for sensitive actions, plus short enough session lifetimes that revocation is not merely cleanup after the fact.

The inventory sounds obvious, but ordinary users will ignore a page listing 37 sessions unless the labels are comprehensible. “Chrome on laptop” is not enough if one laptop has several browser profiles. Good UX matters as much as the underlying token model.

Worth keeping the claim bounded: the brief supports session hijacking when a valid session identifier is captured, not that every passkey deployment creates unusually long-lived cookies. I support the proposed dashboard, especially if it explains that one device can represent multiple sessions.

One-click revocation is the rare security feature people can understand under stress. I’d put it beside “sign out everywhere,” explain the consequences in plain language, and avoid pretending approximate activity times are proof that a device is currently in use.

I’m less worried about synced passkeys than about account recovery and screen locks. A properly locked phone and a separate browser profile change the scenario substantially. Still, a session inventory costs little privacy-wise if it reports only service, device class, and last activity.

The old rule survives: if someone has your unlocked computer, the computer is theirs for practical purposes. Passkeys reduce one class of mistake; they do not repeal that rule. Give me revocation, reauthentication for sensitive changes, and fewer mystery sessions.