by Christopher Harrell , Chief Executive Officer

Passwords are on their way out and passkeys are replacing them. According to Yubico, passwords are on their way out. In their place is a new form of login called passkeys that promises stronger security and less frustration. All passkeys offer the rare combination of improved usability and stronger security, especially when compared to passwords alone. But, unless we act now, millions could be left more vulnerable than ever.

“The global momentum behind passkeys represents one of the most exciting shifts in authentication history,” says Christopher Harrell, chief technology officer at Yubico.

“The technical specifications that enable this shift are FIDO2 and WebAuthn, and their implementations are now widely known by the consumer-friendly name ‘passkeys’. As the creator of the first passkeys, passkeys in security keys, Yubico is proud and humbled to have helped initiate and to be continuing to drive this transformation. Yet, the work isn’t done. Not all passkeys are equal. Not all users have the same needs, and leaving insecure fallback methods in place can provide a false sense of security.”

This is how security leaders, builders, product managers, and individuals can make sure passkeys work for everyone

SYNCED VERSUS. DEVICE-BOUND PASSKEYS: THE CRITICAL DIFFERENCE

Synced passkeys

For many people, passkeys are synonymous with synced passkeys where the private key is stored in the cloud and copied between devices. Synced passkeys offer a practical, user-friendly solution for some use cases, but they depend heavily on the security and availability of the synchronisation mechanism, recovery systems and processes, and the cloud accounts they are tied to.

For people and organisations that face higher risks, have greater sensitivity or accessibility needs, or individuals who just want the best protection for their finances or other critical accounts, synced passkeys are insufficient.

Device-bound passkeys

Device-bound passkeys never leave the secure hardware on which they are created. They provide the strongest protection against phishing, account takeover and recovery abuse. There are two primary implementations:

• Smartphone/laptop-based. These can be convenient, but are not always an available option and can provide inconsistent experiences. For example, most smartphone-based passkey solutions have usability challenges because of confusing QR codes, buggy or missing Bluetooth and unreliable relay access.

• Hardware security keys (like YubiKeys). These are the , and the gold standard. They offer the highest security assurance by providing portable, crossplatform and consistent passkey experiences. They serve as a root of trust for every use case, across borders and in high-risk situations.

Bottom line: synced passkeys should be the baseline. Device-bound passkeys must be an option, and in some cases, the requirement.

The Recovery Gap

Even with device-bound passkeys enabled, accounts remain vulnerable if weaker recovery methods are still allowed:

• Text messages

• Code-generation apps

• Push notification approvals

• Number matching prompts

Harrell says: “Attackers understand this and actively downgrade to insecure, phishable mechanisms to avoid the phishing-resistant security passkeys provide.”

CIOS AND CISOS: DEMAND CONFIGURABILITY AND CONTROL

According to Harrell, enterprise-grade protection means control over authentication policies. “Passkeys in YubiKeys and Windows Hello for Business are better together, offering non-exportable credentials that cannot be silently synced, phished or copied. These passkeys can provide clear visibility into how and where they are stored, which enables more consistent support, audit and incident response processes.”

Key requirements to demand from identity providers and partners are that they:

• Ensure all identity providers use only devicebound passkeys.

• Require device-bound passkeys, even for services outside the single sign on.

• Disable synced passkeys for enterprise use.

• Use passkeys in security keys as a root of trust for self-service recovery, transition, and step-up.

• Remove all non-FIDO fallback methods.

• Enforce identity providers use only devicebound passkeys.

• Require device-bound passkeys even for services outside the SSO.

• Disable synced passkeys for enterprise use.

• Use passkeys in security keys as a root of trust for self-service recovery, transition and step-up.

• Remove all non-FIDO fallback methods.

Hassall says: “To make this work, the services used have to allow it. Organisations should demand configurability from identity providers, workforce tools and partners. Think about protecting your organisation with authentication designed for the realities of your threat landscape. Organisations that do this see fewer recovery events, lower costs and greater resilience.”

ADVICE FOR PRODUCT MANAGERS: BUILD IN CHOICE

He adds: “Don’t exclude security keys; it often takes more effort to block them than to support them. And if you’re stuck, technically or from a usability perspective, Yubico is here to help. We’ve partnered with governments, Fortune 500s and identity platforms to solve many challenges at scale across the globe.

“As a product leader or engineer rolling out passkey support in your application you are shaping the future of digital identity and safety. If you’re building a banking app, social network, government portal, an identity provider or anything else, you are also deciding who gets access to higher levels of protection.”

Benefits

• Enterprises that offer strong security policies can save time and money and harden recovery flows against social engineering.

• High-value accounts can use the strongest phishing resistance to protect all assets.

• At-risk individuals and organisations, ranging from journalists and whistleblowers to those securing political processes or members of marginalised communities depend on YubiKeys as a lifeline

• People with accessibility needs often prefer, or need, portable hardware security keys because of their predictable, tactile and cross-platform experience that reduces screen reader challenges and eliminates complex or unfamiliar gestures.

• The stakes are global and personal: build a passkey future that works for everyone.

“Authentication should be adaptable and flexible, not rigid and monolithic. Higher-assurance security is not just for the enterprise; it’s a lifeline for millions,” says Harrell.

Here are just a few people and groups who need the strongest passkey protections:

• Government officials, diplomats and military leaders.

• Legal workers, judges and law enforcement.

• High-profile executives, influencers and celebrities.

• Developers and maintainers of software and systems.

• Security practitioners and researchers.

• Survivors of domestic violence or trafficking.

• Activists, journalists and other vulnerable populations or organisations.

• Those without reliable access to a personal phone or computer.

• People with accessibility needs.

• Everyday individuals who want the best protection.

A person or organisation can become ‘at-risk’ overnight through a political event, security incident or public exposure. Having the ability to quickly improve security posture can dramatically increase safety and peace of mind.

Whether you lead a security program, build products for millions or care about your own accounts:

• Support or require security keys as a core part of your passkey strategy.

• Demand configurability and the ability to disable insecure fallbacks.

• Ensure everyone has the option to choose the protection level they need.

For more information on passkeys see Yubico’s new infographic and eBook www.linkedin.com/in/cnhcnh