Passkeys are finally replacing the password
Phishing-resistant sign-in has crossed from standards work into default consumer behaviour. Account recovery is the remaining weak point.
The password's failure mode was never complexity. It was reuse and disclosure: a credential the user can type is a credential the user can be persuaded to type somewhere else.
What passkeys change
A passkey binds the credential to the origin and keeps the private key on the device. There is nothing to phish, because there is nothing the user can transcribe into an attacker's form. Adoption has followed platform defaults rather than security campaigns, which is generally how security improvements actually reach scale.
Where the risk moved
- Recovery flows: an account protected by a passkey and recoverable by an emailed code is protected by that emailed code.
- Device loss: synchronisation solves the practical problem and moves trust to the platform account holding the keys.
- Enterprise edge cases: shared workstations and contractor access remain awkward under a device-bound model.
An authentication system is only as strong as the process for getting back in when it fails.
The measurable improvement is real: organisations that have fully deployed phishing-resistant sign-in report credential phishing dropping close to zero. The attacks that remain target help desks and recovery paths, which are human systems, not cryptographic ones.
Sources
About the author
Security & Web Correspondent
Priya Raman reports on authentication, software supply chains and the changing shape of search and the open web. Her work focuses on how security decisions affect ordinary users.
