1. Only the password leaked
A required second code blocks this attempt because the attacker lacks it. With passkey-only sign-in, the password is not a usable credential.
Computer security · Chapter 1
Can someone get in without my password?
A stronger sign-in check helps at the front door. It cannot, by itself, protect every session that is already signed in. Follow one account through three different situations.
No coding needed. This local illustration uses fictional states, never your passwords, cookies or accounts.
What does the attacker actually have?
A password is a secret you type. An authenticator app adds a changing code. A passkey uses a cryptographic proof tied to the service, usually unlocked with your device’s PIN or biometrics. They protect sign-in in different ways.
Illustrative · fictional account · no real sign-in
Asha uses a fictional photo account. Predict: will this attempt reach her photos? Start with the leaked password, then change only the sign-in protection.
Assume the attacker has only the password. They cannot read Asha’s authenticator app or use her passkey.
1 · The attempt
The correct password only
2 · The check
Advance to see which check is reached.
3 · The outcome
Predict the result before revealing it.
Step 1 of 3. The attempt.
Model limits: correct implementation; no compromised device, recovery bypass, password fallback or attacker-added access method. These outcomes are conditional examples, not measured success rates or a guarantee against account takeover. Real services may require another check for sensitive actions.
Three situations, three different checks
2. A fake site asks for the code too
A fresh code can be relayed to the real service before it expires. A passkey binds the proof to the real service; a different-domain lookalike cannot use that proof in this example.
3. An already-signed-in session is copied
A session token is a temporary way to continue access after login. If the service accepts its stolen copy, another login is unnecessary. Revoking that session at the service removes that particular access route.
These are the lab’s assumptions, not promises about every service. Password fallback, account recovery, device security and session controls also affect the outcome.
Try a different situation
Why can a passkey stop the fake-site login while a copied session can still work? Name the check that is skipped.
Your explanation stays in this page’s memory and disappears when you leave. It is not sent or graded.
Takeaway
Ask which part of access a protection covers: the initial login, the ongoing session, the device, or recovery. “Phishing-resistant” describes an important login property. It does not mean every route into an account has disappeared.
Optional: the technical names
Authentication establishes a login. A session token continues access afterwards. A bearer token can be used by whoever possesses it, subject to the service’s checks. WebAuthn passkeys use public-key cryptography and service binding; the private key is not a password typed into a website. Correct verification and secure recovery remain essential.
Read the sources
- NIST SP 800-63B: authentication, phishing resistance and sessions — why manually entered codes are not phishing-resistant.
- Google for Developers: passkeys — service-bound credentials and device unlock.
- OWASP: session management — session tokens and server-side invalidation.