Passkeys stop credential theft but do not remove identity risk
Original title: Passkeys Are Better Than Passwords. But They Are Not Enough.
A successful passkey login does not prove the account, device, or later session should still be trusted.
SecurityWeek argues that passkeys, which replace shared secrets with device-held private keys, block phishing, credential stuffing, and reuse of stolen passwords better than passwords and many traditional MFA methods. The piece says authentication still does not prove an account was enrolled legitimately, that a device is trustworthy, or that a later session remains safe. It says weak recovery paths and post-login abuse can bypass an intact passkey, and that identity risk should be evaluated continuously.
- Passkeys bind authentication to the legitimate service and do not transmit the private key.
- Recovery via password, SMS, email, knowledge questions, or the help desk can be targeted.
- Session hijacking and account-attribute changes can follow a valid login.
- The author urges risk-based checks rather than friction on every sign-in.
From the original article
4 min read at securityweek.com
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it. The post Passkeys Are Better Than Passwords.
By Torsten George · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.