Passkeys Strengthen Authentication but Leave Identity Risks

Passkeys are presented as a superior alternative to passwords, offering phishing resistance by replacing shared secrets with a cryptographic credential pair and binding authentication to the legitimate service. The SecurityWeek piece explains that with passkeys, the private key remains on the user’s device while the service holds the public key, meaning there is nothing for attackers to steal or reuse across sites.

This reduces risks associated with credential theft, phishing, and credential stuffing and can improve usability since users no longer need to recall complex passwords or re-enter codes. However, the article warns that stronger authentication does not automatically eliminate identity risk. Even with flawless passkey authentication, an account could have been established or enrolled under a compromised or untrustworthy identity, and the system may still be exposed if enrollment and device trust are not sound.

The article argues for a broader approach that goes beyond authentication. It emphasises the need to consider recovery and enrollment integrity, device changes, and the ongoing trustworthiness of an identity after authentication. It also notes that attackers may pivot to weaknesses around recovery paths or enrollment when passkeys are deployed.

To address this, SecurityWeek advocates combining passkeys with continuous identity threat detection, which evaluates risk using device characteristics, behaviour, account changes, and surrounding context. In this model, authentication is necessary but not sufficient; authorities must continuously assess whether the identity and its activity remain trustworthy, especially when users operate from new devices or undergo account changes.