Sync Fabric Is Not a Passkey-Only Risk

Critics often say synced passkeys put too much trust in a vendor cloud. That concern is real—but it is not unique to passkeys. Password managers, email one-time codes, and synced authenticator apps already depend on similar account fabrics.

The UK National Cyber Security Centre (NCSC) paper comparing traditional credentials and FIDO2 for personal use (23 April 2026) makes that parallel explicit: sync risk already exists in everyday MFA, and the right response is to harden the fabric—not to treat passkeys as a special failure mode.

The criticism: synced passkeys put trust in a vendor cloud

A synced passkey is a FIDO2 credential that can be backed up and made available on your other devices through a vendor platform—the sync fabric. If an attacker can take over that account, they may eventually obtain usable credentials on a new device they control.

That is a fair threat to discuss. What is unfair is framing it as if passwords-plus-codes somehow avoid cloud trust. For most people, the same Apple, Google, Microsoft, or password-manager account already holds the secrets that unlock everything else.

You already sync passwords, TOTP seeds, and email

The NCSC paper notes that credential synchronisation is often criticised when attached to passkeys, yet the same principles—and sometimes the same fabrics—apply to traditional MFA.

Standalone and browser password managers typically sync vault contents through a vendor cloud. TOTP seeds stored in those managers sync with them. Email OTP effectively “syncs” wherever you are signed into mail. Those mail accounts are frequently the same identity used to recover the vault itself.

SMS codes and hardware TOTP tokens do not ride the same sync path—but they remain phishable in other ways. Avoiding cloud sync does not automatically mean stronger authentication.

Reused remembered passwords are a worse form of “sync”

If you remember one password and reuse it across sites, you are effectively synchronising that secret to every service that stores it. A breach on a low-value site becomes an unlock for email, banking, or work.

That human “sync fabric” has none of the origin binding or per-account uniqueness that FIDO2 provides. Credential stuffing thrives on it. Compared with a protected vault that syncs unique secrets, reuse is the weaker trust model—not the safer one.

What NCSC observed about first-party fabrics

The FIDO2 specs describe a sync fabric but leave security requirements to vendors. In its 2025 review of first-party fabrics (Apple, Google, Microsoft), the NCSC found that all of them mandated multifactor authentication to store passkeys and supported passkeys or other phishing-resistant authentication for the fabric account itself.

That combination matters: if the vault login is phishing-resistant, “phish the sync fabric” becomes much harder than phishing a password-only vault. First-party ecosystems are not perfect, but they set a higher bar than “any cloud backup.”

Third-party managers vary—choose carefully

Third-party sync fabrics are more uneven. Fabian Bader’s 2026 Disobey talk Are passkeys as secure as you think? (cited by the NCSC) reported that several well-known third-party credential managers did not require MFA merely to create or store passkeys—raising the risk that people protect passkeys behind a sync account that is still only a password.

That finding is about account policy and product defaults, not a claim that passkeys themselves are broken. It also does not mean every third-party manager is weak. The practical takeaway: before you rely on a vault for passkeys, check whether the vault account itself supports strong MFA or a passkey, and whether MFA is required—not merely optional.

A practical checklist for sync fabric security

Treat the account that syncs your credentials as a crown-jewel login. Harden it the way you would harden email recovery.

• Turn on phishing-resistant authentication (a passkey or hardware FIDO key) for the vault / platform account whenever the product allows it.
• Prefer managers and OS vaults that require MFA to enroll or sync credentials—not only optional MFA after the fact.
• Confirm recovery is deliberate and documented: recovery codes, trusted devices, or account-recovery flows you understand before you need them.
• Prefer OS-integrated or hardware-backed credential storage where malware resistance matters, especially on desktop.
• Keep unique, generated passwords for services that still lack passkeys—sync does not excuse reuse.

Single-device FIDO keys avoid sync phishing—but shift risk

Hardware FIDO tokens and other single-device credentials that cannot leave the authenticator are not exposed if someone phishes a sync fabric account. That is a genuine advantage for high-assurance personal use.

The trade-off is availability: lose the only enrolled key without a backup authenticator, and you fall into account recovery for each relying party. Sync is a usability and recovery feature; single-device storage is a containment feature. Choose based on the account’s value and how carefully you manage backups—not on slogans about “never trusting the cloud.”