Passkeys are winning, but security leaders must raise the bar says Yubico

According to Yubico, passwords are on their way out. In their place is a new form of login called passkeys that promises stronger security and less frustration. All passkeys offer the rare combination of improved usability and stronger security, especially when compared to passwords alone. But unless we act now, millions could be left more vulnerable than ever.

"The global momentum behind passkeys represents one of the most exciting shifts in authentication history. The technical specifications that enable this shift are FIDO2 and WebAuthn, and their implementations are now widely known by the consumer-friendly name 'passkeys'. As the creator of the first passkeys, passkeys in security keys, Yubico is proud and humbled to have helped initiate and continue to drive this transformation. Yet, the work isn't done. Not all passkeys are equal, not all users have the same needs, and leaving insecure fallback methods in place can provide a false sense of security," said Christopher Harrell, Chief Technology Officer at Yubico.

This is how security leaders, builders, product managers, and individuals can make sure passkeys work for everyone.

Synced vs. device-bound passkeys: the critical difference

Synced passkeys

For many, passkeys are synonymous with synced passkeys, where the private key is stored in the cloud and copied between devices. Synced passkeys offer a practical, user-friendly solution for some use cases, but they depend heavily on the security and availability of the sync mechanism, recovery systems and processes, and the cloud accounts they're tied to.

For people and organisations that face higher risks, have greater sensitivity or accessibility needs, or individuals who just want the best protection for their finances or other critical accounts, synced passkeys aren't enough.

Device-bound passkeys

Device-bound passkeys never leave the secure hardware where they are created and provide the strongest protection against phishing, account takeover, and recovery abuse. There are two primary implementations:

• Smartphone/laptop-based: These can be convenient, but aren't always an available option and can provide inconsistent experiences. For example, most smartphone-based passkey solutions have usability challenges because of confusing QR codes, buggy or missing Bluetooth, and unreliable relay access.
• Hardware security keys (like YubiKeys): The gold standard and original passkey, offering the highest security assurance by providing portable, cross-platform, and consistent passkey experiences. They serve as a root of trust for every use case, across borders and in high-risk situations.

Bottom line: Synced passkeys should be the baseline. Device-bound passkeys must be an option, and in some cases, the requirement.

The recovery gap

Even with device-bound passkeys enabled, accounts remain vulnerable if weaker recovery methods are still allowed:

• Text messages
• Code-generation apps
• Push notification approvals
• Number matching prompts

"Attackers understand this and actively downgrade to insecure, phishable mechanisms to avoid the phishing-resistant security passkeys provide," said Christopher Harrell.

CIOs and CISOs: demand configurability and control

According to Christopher Harrell, enterprise-grade protection means control over the authentication policies. He said: "Passkeys in YubiKeys and Windows Hello for Business are better together, offering non-exportable credentials that cannot be silently synced, phished, or copied. These passkeys can provide clear visibility into how and where they are stored, which enables more consistent support, audit and incident response processes."

Key requirements to demand from identity providers and partners:

• Enforce only device-bound passkeys in any identity providers
• Require them by policy, even for services outside the SSO
• Disable synced passkeys for enterprise use
• Use passkeys in security keys as a root of trust for self-service recovery, transition, and step-up
• Remove all non-FIDO fallback methods
• Enforce only device-bound passkeys in the identity providers
• Require them by policy, even for services outside the SSO
• Disable synced passkeys for enterprise use
• Use passkeys in security keys as a root of trust for self-service recovery, transition, and step-up
• Remove all non-FIDO fallback methods.

"To make this work, the services used have to allow it. Organisations should demand configurability from identity providers, workforce tools, and partners. Think about protecting your organisation with authentication designed for the realities of your threat landscape. Organisations that do this see fewer recovery events, lower costs, and greater resilience," said Christopher Harrell.

Advice for product managers: build choice in

"Don't exclude security keys; it often takes more effort to block them than to support them. And if you're stuck, technically or from a usability perspective, Yubico is here to help. We've partnered with governments, Fortune 500s, and identity platforms to solve many challenges at scale across the globe," said Christopher Harrell.

"As a product leader or engineer rolling out passkey support in your application, you are shaping the future of digital identity and safety. If you're building a banking app, social network, government portal, an identity provider, or anything else, you are also deciding who gets access to higher levels of protection," said Christopher Harrell.

Benefits

• Enterprises that are offered strong security policies can save time and money, and harden recovery flows against social engineering.
• High-value accounts can use the strongest phishing resistance to protect all assets.
• At-risk individuals and organisations, ranging from journalists and whistleblowers to those securing political processes or members of marginalised communities, depend on YubiKeys as a lifeline. 
• People with accessibility needs often prefer or need portable hardware security keys because of their predictable, tactile, and cross-platform experience that reduces screen reader challenges and eliminates complex or unfamiliar gestures.
• The stakes are global and personal: Build a passkey future that works for everyone.

"Authentication should be adaptable and flexible, not rigid and monolithic. Higher-assurance security is not just for the enterprise; it's a lifeline for millions," said Christopher Harrell.

Here are just a few people and groups who need the strongest passkey protections the most:

• Government officials, diplomats, and military leaders
• Legal workers, judges, and law enforcement
• High-profile executives, influencers, and celebrities
• Developers and maintainers of software and systems
• Security practitioners and researchers
• Survivors of domestic violence or trafficking
• Activists, journalists, and other vulnerable populations or organisations
• Those without reliable access to a personal phone or computer
• People with accessibility needs
• Every day individuals, who want the best protection.

A person or organisation can become "at-risk" overnight through a political event, security incident, or public exposure. Having the ability to quickly improve security posture can dramatically increase safety and peace of mind.

Whether you lead a security program, build products for millions, or care about your own accounts:

• Support or require security keys as a core part of your passkey strategy
• Demand configurability and the ability to disable insecure fallbacks
• Ensure everyone has the option to choose the protection level they need

For more information on passkeys, see Yubico's new infographic and eBook.