Passkeys Are Better Than Passwords. But They Are Not Enough
SecurityWeek, Friday, October 30th, 2026
SecurityWeek argues passkeys beat passwords but are not enough, since enrollment integrity, device changes and session takeover still matter.
Passkeys use public-key cryptography, so no reusable secret can be phished, stolen from a database or used for credential stuffing, and they improve usability over passwords with SMS or push codes.
The author argues authentication is not identity: a successful passkey login proves a credential was used, not that the account was legitimately created, the device is trustworthy, or the session is not attacker-controlled.
If an attacker controls an account before a passkey is bound to it, the organization securely authenticates the wrong person, so enrollment integrity grows more important.
The piece also raises what happens when a user's device changes.