Passkeys Strengthen Authentication but Don’t Solve Identity Security

Summary

Passkeys reduce phishing and reusable-credential risks, but organizations still need to secure identity enrollment and recovery and monitor for device, session, and account risks after authentication.

Key points

• Passkeys use public-key cryptography and keep the private key on the user's device, reducing phishing and credential-stuffing risks.
• Strong authentication cannot establish that an account was created by or still belongs to the legitimate person.
• Account recovery and adding a new device can create weaker paths if they rely on passwords, SMS, email links, knowledge questions, or help desks.
• Successful authentication does not prevent later session hijacking, device compromise, privilege abuse, or anomalous account activity.
• The article recommends continuously assessing identity risk using device, behavioral, network, account-change, and transaction context, with additional checks when risk changes.