Passkeys: what they fix and the account recovery hole

I have enough well-sourced material. Writing the post now.

The login that cannot be phished, and the back door that can

In the summer of 2023, the casino giant MGM Resorts was brought to its knees not by a cracked password or a zero-day exploit, but by a phone call. A group of young hackers known as Scattered Spider looked up an employee on LinkedIn, called the IT help desk pretending to be them, and asked, politely, for a password and multi-factor reset. Ten minutes later they were inside. The outage that followed cost MGM an estimated $100 million. No login screen was ever defeated. The attackers simply asked to be let back in the way any locked-out user would. Hold that story. It is the shadow that falls across the most important improvement to online security in a generation.

The problem passkeys were built to kill

Passwords fail in a specific, structural way: they are a shared secret. You know your password, and the website you log into stores something derived from it. Anything you can type into the real site, you can be tricked into typing into a fake one, and anything the site keeps can be stolen in a breach. That single design flaw drives most of the damage online. The scale is not a matter of opinion. Verizon's 2025 Data Breach Investigations Report, which dissects tens of thousands of real incidents, found that credential abuse was the single most common way attackers got their initial foothold, present in 22 percent of breaches, with phishing behind another 16 percent. Look at attacks on web applications specifically and the picture is starker: 88 percent involved stolen credentials. The report's blunt framing is that the human element, meaning someone tricked, phished, or reusing a bad password, played a part in around 60 percent of breaches. Two-factor authentication helped, but the common forms leak too. A code sent by SMS or generated by an app is just another secret you can be persuaded to read aloud to a convincing fake. Attackers built entire phishing kits, so-called adversary-in-the-middle proxies, that sit between you and the real site, relay your password and your one-time code in real time, and steal the resulting session. The secret changed. The fundamental weakness did not.

What a passkey actually is

A passkey replaces the shared secret with a pair of cryptographic keys. When you create one, your device generates two mathematically linked keys: a private key that never leaves the device, and a public key that gets sent to the website. The public key is useless to a thief. It can verify a signature but cannot produce one, the way a padlock can confirm a key fits without revealing the key's shape. Logging in works as a challenge and response. The site sends your device a random challenge. Your device signs it with the private key, and the site checks the signature against the public key it has on file. Nothing reusable ever crosses the network. There is no secret in a database for an attacker to steal, because the only thing the site holds is a public key that was always meant to be public. This is not a brand-new idea bolted onto the web. It is a formal standard with a long runway. The FIDO Alliance, an industry body whose name stands for Fast Identity Online, was founded in 2013 precisely to kill the password. Its work became a web standard in March 2019 when the World Wide Web Consortium and FIDO finalized WebAuthn, the browser interface that lets any website ask for a signature. Underneath sit two pieces that together are called FIDO2: WebAuthn, which connects the website to your device, and CTAP, the Client to Authenticator Protocol, which lets your laptop talk to a roaming authenticator such as a phone or a hardware key. The word "passkey" is the consumer-friendly name that Apple, Google, and Microsoft agreed to in May 2022 for a FIDO2 credential you can actually live with day to day. The part you experience is deliberately mundane. You unlock the private key with something you already do to open your phone: a fingerprint, a face scan, or a device PIN. That biometric never leaves your device and is never sent to the website. It is a local gate that releases the key, not a secret that travels.

Why phishing simply stops working

Here is the mechanism that makes passkeys genuinely different, and it is worth slowing down for, because it is where the real security comes from. When your device creates a passkey, it binds it to the exact origin of the website, meaning the specific domain such as login.yourbank.com. Every signature your device produces includes that origin, and the browser enforces the match. If you land on login.yourb─ank.com, a lookalike domain using a substituted character, the browser will not release a signature for the real bank. Not because you were careful, but because the origins do not match and the software refuses. This closes the door that human vigilance never could. The whole art of phishing is making a fake site look real enough to fool a person. Passkeys move the check away from the person and into the browser, which is not fooled by appearances because it never looks at appearances. It looks at the origin string. This is why the industry calls passkeys phishing-resistant rather than just phishing-resilient: there is no valid credential to hand over on the wrong site, even if you desperately want to. The payoff is showing up in real deployments. By the FIDO Alliance's 2026 count, more than 15 billion online accounts can now use passkeys and roughly 5 billion passkeys are in active use. Google has reported over 800 million accounts using them, with sign-ins that are faster and succeed more often than passwords. On World Passkey Day 2025, FIDO found that 74 percent of consumers were aware of passkeys, 69 percent had enabled them on at least one account, and 48 of the top 100 websites supported them, more than double the share from a few years earlier.

The misconception worth clearing up

Ask people why they have not switched, and one worry comes up again and again: "If my passkey lives on my phone, and I drop my phone in a lake, am I locked out of everything forever?" For most people today, the answer is no, and the reason exposes the central tension in the whole design. There are really two kinds of passkeys. Device-bound passkeys live on one piece of hardware, typically a physical security key, and never leave it. Synced passkeys, which is what you get by default on an iPhone or an Android phone, are copied through your Apple, Google, or password-manager account to your other devices. Drop the phone, buy a new one, sign back into your Apple or Google account, and your passkeys are simply there. Syncing is what made passkeys usable for ordinary people rather than just security professionals with a drawer of hardware keys. Apple stores synced passkeys in iCloud Keychain with end-to-end encryption, meaning they are encrypted on your device before they leave it and Apple cannot read the key material, with rate limits to frustrate brute-force guessing. Google's approach is similar. But look closely at what syncing does. It converts "something physically in my hand" into "something protected by my cloud account." And that quietly moves the weakest point in the whole system.

The account recovery hole

Every security system has to answer one awkward question: what happens when the legitimate user genuinely loses their credential? For passwords, the answer was the "forgot password" email. For passkeys, there is no password to reset and no private key the website can re-send, because it never had the private key in the first place. So the recovery path has to lean on something else, and that something else is almost always weaker than the passkey it is backing up. This is the hole. A passkey can be flawless at the front door and still be undone by the back door built to let you in when you are locked out. Three versions of the problem are already being exploited.

The help desk is the softest target

Return to MGM. The company may well have had strong authentication in place. It did not matter, because the attackers never touched it. They went to the human recovery process, the help desk, and talked their way past it. The US cybersecurity agency CISA later documented Scattered Spider's method in detail: gather an employee's details from public sources, call IT, and request a credential or MFA reset. The technique is old and unglamorous, which is exactly why it keeps working. A phishing-resistant login raises the value of the recovery process to an attacker, because it becomes the only door left unlocked.

The downgrade trick

Attackers do not always need a human. Because browser and operating-system support for passkeys is still uneven, sites keep fallback methods available, and a fallback is by definition weaker. Security researchers at Proofpoint demonstrated a downgrade attack against Microsoft's Entra ID identity service: an adversary-in-the-middle proxy pretends to be an unsupported browser, such as Safari on Windows. The identity provider, trying to be helpful, notices that passkeys will not work in that browser and offers a weaker option like a one-time code instead. The proxy captures that code and the session, and the passkey the user carefully set up is never even offered. The strong lock was there; the system was persuaded to walk past it.

Cloud account takeover and the sync trade-off

Then there is the consequence of syncing. If your passkeys are recoverable through your Google or Apple account, then that account is now the master key to everything the passkeys protect. Take it over, whether through a recovery-process weakness, a help desk, or an infostealer that has scraped a session, and you can authorize a new device and pull down the whole keychain onto hardware the real owner has never seen. The encryption is strong, but as security researchers keep pointing out, a synced passkey is ultimately only as strong as the account and the recovery process guarding the vault it syncs through. This is the honest asterisk on the convenience of sync, and it is a real debate rather than a settled one. None of this means passkeys are broken. It means the attacker's job changed from "steal the credential" to "abuse the process that reissues the credential," and defenders have been slower to harden the second thing than to celebrate the first.

What is being built to close the gap

The hole is well understood inside the industry, and several fixes are converging. The simplest is procedural. Security engineers increasingly push a two-credential rule: when you register your first passkey, immediately register a second one on a different device or a hardware key, and store a set of one-time recovery codes offline. If recovery becomes just "use your other passkey," it stops being a soft human process an attacker can sweet-talk. The catch is that almost nobody does this voluntarily, so it only helps at scale if services make it the default. The deeper fix targets the lock-in that made sync feel mandatory. Until recently, your passkeys were effectively trapped in whichever ecosystem created them, so leaving Apple for Android meant abandoning them, which pushed everyone toward a single all-powerful cloud account. The FIDO Alliance is standardizing a way out: the Credential Exchange Format and Credential Exchange Protocol, which let you move passkeys between providers without ever exposing them as plain text. The format was approved as a proposed standard in August 2025, with the transfer protocol, which uses strong public-key encryption to protect credentials in transit, targeted for early 2026. Apple, Google, Microsoft, 1Password, Bitwarden, and Dashlane are all contributors, and Apple has already shipped format-based transfer in recent versions of iOS and macOS. Portability will not fix the help desk, but it weakens the argument that you must trust one company with everything. Hardening the human recovery process is the least glamorous and most important piece, and it is mostly organizational rather than technical: requiring stronger identity proofing before a reset, adding delays and out-of-band confirmation, and refusing to let a single phone call undo strong authentication. Regulators and standards bodies are beginning to treat recovery as part of the security boundary rather than a customer-service afterthought. That shift in mindset may end up mattering more than any cryptographic advance.

What to watch

Passkeys have already won the technical argument. The shared secret, the thing that made phishing and credential theft into an industrial-scale business, is being replaced by cryptography that cannot be phished, reused, or lifted from a breach. Five billion of them in active use is not a pilot program; it is infrastructure. The open question is whether the ecosystem has the discipline to finish the job at the back door instead of the front. A lock is only as good as the spare-key policy, and right now the spare keys are handed out by a call center reading from a script and by cloud accounts protected, often, by the very passwords passkeys were meant to retire. The interesting security stories of the next few years will not be about someone defeating a passkey. They will be about someone avoiding one entirely, and phoning the help desk instead.

Sources

1. Verizon, 2025 Data Breach Investigations Report, 2025.
2. FIDO Alliance, Passkeys overview, accessed 2026.
3. FIDO Alliance, FIDO Alliance Champions Widespread Passkey Adoption and a Passwordless Future on World Passkey Day 2025, 2025.
4. FIDO Alliance, The State of Passkeys 2026: Global Consumer and Workforce Report, 2026.
5. FIDO Alliance, W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins, 2019.
6. Apple, About the security of passkeys, accessed 2026.
7. The Hacker News, How Attackers Bypass Synced Passkeys, 2025.
8. CISA, Scattered Spider (advisory AA23-320A), 2023.
9. TechTarget, Okta: Caesars, MGM hacked in social engineering campaign, 2023.
10. TechTarget, FIDO unveils new specifications to transfer passkeys, 2024.
11. FIDO Alliance, Credential Exchange Format specification, 2025.