My latest NotebookLM video summarizes Bredemarket’s posts on passkeys.
And yes, Bredebot is one of the cited sources. Note the wildebeest/wombat reference.
Tag Archives: passkey
Passkeys, You Are the Weakest Link. Goodbye?
Passkeys are great and wonderful and stuff, but what if you bypass them? Then they are the weakest link.
I’ve played with passkeys a bit, but have to consider what happens if I lose access to the passkey. As it turns out I’m not locked out forever, because there are built-in recovery methods if this happens.
The problem
However, Google’s Claire Forszt points out that weak account recovery methods introduce a new problem.
“If a passkey can be recovered with a lower security bar than the passkey holds, then the security benefit essentially becomes moot.”
This gives the bad people ways to get into your account via account recovery. Making the passkey the weakest link.
The solution
But there is a more secure way to recover an account: use of digital identity credentials.
“In Google’s scheme, users register a signed digital identity credential as a recovery method in advance. The credential is used to generate a unique cryptographic identifier, or ‘stable hash,’ linked to the user’s account.”
Of course, this can’t be generally used for account recovery until a sizable number of people HAVE digital credentials. Google thinks we’ll reach that point by 2030.
One more thing
But Non-Functional asserts that there is another problem with passkeys.
“What’s important to know is that unlike with any other kind of login credential, you do not have ultimate control over your passkeys….[W]ith passkeys come a hidden dial that lets the websites you use them on gradually remove your ability to do as you please with them and to use them with the devices and software you prefer.”
Specifically, there is a difference between attested and non-attested passkeys, and if a website insists on attested passkeys you could be locked out. Read more, including the author’s conspiracy theories about the true motives of the FIDO alliance, here.
(Because of my present and past professional association with FIDO Alliance members, I am sworn to secrecy regarding its annual meetings on September 31 in an underground bunker in Brussels.)
If You Missed This Morning’s Passkey Talk
Passkey talk reigned o’er Bredemarket early this morning with two passkey-related posts from Bredebot and me.
It started with my buddy Bredebot sharing “Passkeys Explained: The Pros and Cons of a Passwordless Future.” Here’s a bit of what he said:
“The advantages of passkeys are massive. First off, they render traditional phishing nearly impossible….They also eliminate password fatigue—no more resetting forgot-it-again passwords or reusing weak combinations like “Password123!” for sensitive accounts….
“However, passkeys aren’t without their disadvantages. The biggest hurdle right now is cross-ecosystem friction….Account recovery is another sticky point.”
Then I followed up with my latest, “Death of Passwords Via Passkeys? Not Yet.” Yeah, I’m a one-note band on this ridiculous “death of passwords” thing.
But we’re saying more. Tomorrow morning Bredebot will continue passkey talk by addressing how we store passkeys. Another fun topic.
Death of Passwords Via Passkeys? Not Yet.
For those who predicted the death of passwords via passkeys, it hasn’t happened yet.
As I’ve noted, people have been preaching the death of passwords for decades. And we would kill passwords with passkeys. Bredebot has discussed passkeys previously.
But the FIDO Alliance acknowledges that passwords are still standing.
“The 2026 Passkey Index shows that 90 percent of active accounts are eligible for passkeys, while 42 percent of eligible accounts have a passkey enrolled.”
So keep on thinking of those lower case letters, upper case letters, numbers, and special characters.