Passkeys Are Better Than Passwords. But They Are Not Enough.

For decades, passwords have been one of cybersecurity’s most persistent weaknesses. Users forget them, reuse them, share them, and surrender them to convincing phishing sites. Attackers steal credentials, automate credential stuffing, and increasingly use artificial intelligence to make social engineering more effective.

What are passkeys?

Passkeys promise to eliminate much of this problem.

Built on public-key cryptography, passkeys replace shared secrets with cryptographic credentials. There is no password for an attacker to steal, intercept through phishing, or reuse against another service. Properly implemented passkeys are also phishing-resistant because authentication is bound to the legitimate service.

That represents a significant improvement over passwords and many traditional forms of multi-factor authentication (MFA). But it does not answer a more fundamental question: Just because someone successfully authenticated, should we continue to trust that identity?

Passkeys strengthen authentication. They do not eliminate identity risk.

What Passkeys Get Right

Traditional authentication frequently relies on...

Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE