OEX TECH by SaaSCentrix

$ auth --passkeys

Passkeys in practice, including the awkward parts

Passkeys are a genuine improvement and worth deploying. They also move the problem rather than removing it, and the place they move it to is usually under-designed.

Updated 2026-09-10

The short answer

Passkeys eliminate password reuse, phishing and credential stuffing outright, because there is no shared secret to steal or trick out of someone. What they do not solve is account recovery: when someone loses every device holding a passkey, your recovery flow becomes the weakest point in the system, and attackers will target it precisely because everything else got harder.

What genuinely improves

  • Phishing stops working - a passkey is bound to the site it was created for
  • Password reuse becomes irrelevant, because there is no password
  • Credential stuffing has nothing to stuff, since a breach of one site yields nothing usable
  • Support load drops once people are enrolled - most password tickets are resets

The recovery problem, stated plainly

  • Someone will lose every enrolled device. Plan for it before you launch, not after
  • Design recovery as deliberately as authentication - it is now the softest target you have
  • Encourage a second enrolled device, or a platform account that syncs, at enrolment
  • Beware the fallback that undoes everything: an email-based reset restores phishability

Rolling it out without a support crisis

  • Offer passkeys alongside existing sign-in first; do not force the switch
  • Enrol a pilot group who can tolerate friction and will report honestly
  • Write the explanation in plain language - most people have no mental model for this
  • Only remove password sign-in once enrolment is high and recovery is proven

Common questions

What happens if someone loses their phone?

If their passkeys sync through a platform account, they sign in on a new device and continue. If not, they need your recovery flow - which is exactly why that flow deserves as much design attention as the login itself.

Are passkeys enough on their own, or do we still need MFA?

A passkey is already multi-factor in practice: possession of the device plus the biometric or PIN that unlocks it. Stacking a code on top usually adds friction without adding much security. Spend that effort on recovery instead.