securityweek.comarticlePasskeys Are Better Than Passwords. But They Are Not Enough.
Opinion piece arguing that passkeys, built on public-key cryptography, resist phishing, credential stuffing and password theft but do not settle identity risk. Attackers can go around them through account enrollment before a passkey is bound, weaker recovery paths (SMS, email link, help desk), device changes and authenticated session hijacking. It proposes layering identity threat detection with risk-based, continuous evaluation of trust.
TL;DR Argues passkeys harden authentication but attackers shift to enrollment, recovery and session abuse, so continuous identity threat detection is needed.
Technologies named here
- Passkeys
- Multi-factor authentication
- Identity threat detection
Techniques named here
- Phishing
- Credential Stuffing
- Adversary-in-the-middle
- Social engineering
- Session Hijacking
- Account recovery abuse
- MFA fatigue
- SIM swapping
Concepts named here
- Account recovery and device change
- Continuous risk evaluation
- Enrollment integrity
- identity threat detection
- Passkey synchronization
- Phishing-resistant authentication
- Risk-based authentication
Related in Identity & Access
huntress.comarticleEducation Under Attack: The Pattern Behind Recent University Breaches
huntress.comarticleNext-Gen Phishing Tactics Users Aren’t Ready For | Huntress
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
