{
  "slug": "passkeys-prove-login-not-transaction",
  "title": "Passkeys prove you logged in. Who signed the wire?",
  "summary": "Passkeys made login unphishable, a real win. But WebAuthn authenticates a session start, and every action after it rides a cookie. Here is the gap and how to close it.",
  "lede": "Passkeys are the best thing to happen to authentication in twenty years. They also created a blind spot that most security teams have not measured, because a passkey proves how a session started and says nothing at all about what happened inside it. This is a walk through exactly what a WebAuthn assertion signs, why a re-authentication prompt does not confirm a transaction, and how to close the gap using the deployment you already have.",
  "date": "2026-09-03",
  "reading_time": "16 min read",
  "category": "Standards",
  "tags": [
    "passkeys",
    "WebAuthn",
    "transaction confirmation",
    "session hijacking",
    "dynamic linking",
    "PSD2",
    "phishing-resistant MFA"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Passkeys%20And%20Transactions/1200_630/blog.jpg",
  "url": "/blog/passkeys-prove-login-not-transaction.html",
  "wordcount": 3986,
  "related": [
    "wedge-fit-ic3-reread",
    "your-okta-weakest-link",
    "crypto-withdrawal-authorization"
  ],
  "schema": "Article"
}