Passkeys Are Stronger Than Passwords, But Not Enough
Passkeys offer a powerful alternative to traditional passwords through public-key cryptography, but they alone cannot eliminate broader identity risks.
Radwan AbdulhadiEditor and technology writer
The Evolution of Authentication
For decades, traditional passwords have stood out as one of cybersecurity’s most persistent weaknesses. Users frequently forget them, reuse them across multiple services, share them, and inadvertently surrender them to convincing phishing sites. Attackers routinely steal credentials, automate credential stuffing attacks, and increasingly leverage artificial intelligence to make social engineering tactics far more effective.
To combat these persistent challenges, passkeys promise to eliminate much of the risk. Built upon public-key cryptography, passkeys replace shared secrets with cryptographic credentials. Because there is no password for an attacker to steal, intercept through phishing, or reuse against another service, properly implemented passkeys are inherently phishing-resistant. This mechanism represents a significant improvement over passwords and many traditional forms of multi-factor authentication.
What Passkeys Get Right
Traditional authentication methods frequently rely on passwords combined with one-time passcodes, SMS messages, or push notifications. Although these combinations are stronger than passwords alone, they remain deeply vulnerable to phishing, adversary-in-the-middle attacks, MFA fatigue, and SIM swapping. Furthermore, users often encounter additional risks when authentication creates a false sense of security across enterprise networks.
Passkeys fundamentally change this operational model. Instead of presenting a reusable secret, a user's device holds a private cryptographic key while the service retains a corresponding public key. The private key is never transmitted during the authentication process. This architecture provides meaningful protection against credential stuffing, database theft, and attacks built around stealing reusable credentials. Additionally, passkeys improve general usability by removing the burden of remembering complex passwords or retrieving authentication codes.
Authentication Is Not Identity
Despite these cryptographic advantages, a successful passkey prompt only provides strong evidence that a credential associated with an account completed the authentication process. It does not answer a fundamental question: Just because someone successfully authenticated, should we continue to trust that identity? A perfectly functioning authentication mechanism cannot automatically compensate for an account that should never have been trusted in the first place.
If an attacker manages to establish or take control of an account before a passkey is securely bound to it, organizations may subsequently perform highly secure authentication of the wrong person. As authenticators grow stronger, the overall integrity of the initial enrollment process becomes significantly more critical for security teams.
Handling Device Changes and Recovery
Legitimate users do not always authenticate from the same device. Phones are frequently lost, stolen, damaged, or replaced, employees receive new corporate laptops, and consumers regularly switch technology ecosystems. While passkey synchronization addresses many of these common scenarios by making credentials available across supported devices, organizations must still accommodate users who arrive without access to their expected passkey.
At this point, the operational challenge shifts from authentication to recovery and the re-establishment of trust. Organizations must determine whether someone requesting access from an unfamiliar device is the actual account owner. If fallback mechanisms rely on weaker methods such as a password, SMS code, email link, knowledge-based question, or help desk process, attackers can easily target those vulnerable recovery paths to bypass the passkey entirely.
Moving Beyond the Login Screen
Another critical security gap emerges after the initial authentication phase. Many traditional identity architectures operate on a simple sequence: authenticate the user, grant access, and trust the resulting session indefinitely. However, modern identity-based attacks do not necessarily stop at the login screen. Attackers frequently hijack authenticated sessions, compromise trusted devices, abuse user privileges, manipulate account attributes, or conduct anomalous transactions.
To address these post-authentication risks, organizations can layer identity threat detection on top of existing security measures. Rather than treating a successful login as a permanent declaration of trust, security systems can continuously evaluate risk based on device characteristics, behavioral anomalies, network intelligence, and transaction context. This risk-based model ensures that organizations do not just verify whether a user possessed the right credential, but continuously evaluate whether the identity itself remains trustworthy throughout its entire lifecycle.
Sources
- SecurityWeekPasskeys Are Better Than Passwords. But They Are Not Enough.
Continue chronologically
Related entity coverage
Related stories
Revolve Data Breach Exposes Data of Over 180,000 People
Online fashion retailer Revolve discloses a data breach impacting at least 180,000 individuals after hackers accessed its e-commerce platform.
Cybersecurity Roundup: Anthropic Breach Dispute and Server Flaw
A weekly cybersecurity roundup details an Anthropic breach dispute, a critical 16-year-old UEFI server flaw, and an AI data leak at Cloudflare.
Drupal Warns of Active Exploits Against Commerce Core Flaw
Drupal urges online store owners to patch a critical Commerce Core access bypass vulnerability actively being exploited in the wild.
Capcom Discloses Data Breach Impacting Millions of Users
Japanese gaming giant Capcom has suffered a data breach exposing over 11 million email addresses and account details via unauthorized access.
