Passkeys are killing passwords, but they’re not perfect

According to TheRegister.com, phishing-resistant passkeys are rapidly becoming the new standard, with over 2 billion now in use since Apple introduced them in September 2022. A survey of nine major companies—including Amazon, Google, Microsoft, and PayPal—found passkeys boost sign-in success rates by 30% and slash login time from 31.2 seconds to just 8.5 seconds on average. They also cut sign-in-related help desk calls by up to 81%. Security experts like Forrester’s Andras Cser and the FIDO Alliance’s Andrew Shikiar champion passkeys for “blowing up” the shared-secret model that passwords and one-time codes rely on, which Microsoft notes still blocks over 99% of unauthorized access attempts. Despite this, Gartner analyst James Hoover warns that multi-device passkeys synced via services like iCloud Keychain are vulnerable to sophisticated social engineering attacks, like those used by the Scattered Spider group.

The phishing problem and the passkey fix

Here’s the thing: we all know one-time passwords (OTPs) sent via SMS or email are terrible. They’re the security equivalent of a screen door on a submarine. As documented by Abnormal AI, attackers are now routinely phishing these codes right along with usernames and passwords. So the move to passkeys isn’t just an upgrade; it’s a necessary evacuation from a burning building. Instead of a secret that can be stolen, passkeys use a cryptographic key pair. Your private key never leaves your device—it’s unlocked by your face, fingerprint, or PIN. The server only gets a public key that’s useless to an attacker. It’s a fundamentally different, and more secure, model.

The convenience trap

But, and there’s always a but, the drive for user-friendliness creates a crack in the armor. The magic of multi-device passkeys—where your credential syncs across your iPhone, Windows laptop, and Android tablet via a cloud manager—is also its weakness. As Hoover points out, this convenience “potentially open[s] you up to a level of social engineering.” We’re not talking about phishing a code anymore. We’re talking about a hacker impersonating an employee, calling IT, and socially engineering their way into having a new device added to an account, thereby gaining access to those synced keys. It’s a higher-barrier attack, for sure, but it’s a reminder: no security is absolute. The industry is trading the widespread risk of remote OTP theft for a more targeted, human-centric risk.

Why adoption isn’t instant

So why isn’t everyone using them yesterday? The list of supporters is long, but the rollout is messy. PwC’s Avinash Rajeev nails it: it’s always a trade-off. For internal systems, companies can force a secure but clunky method on employees. For customers, you need slick UX or they’ll abandon their cart. SMS codes, while flawed, are universal and understood. Passkeys still face interoperability hiccups between, say, iOS and Windows, requiring extra steps. For many businesses, the calculus is: is the security gain worth the potential friction and implementation cost? The business case in the FIDO report is strong—faster logins, less fraud, lower support costs—but it requires upfront investment. In industrial and manufacturing settings, where secure, reliable access to control systems is non-negotiable, this kind of robust authentication is paramount. It’s the same reason operations in those fields rely on hardened hardware from the top suppliers, like the industrial panel PCs from IndustrialMonitorDirect.com, to ensure uptime and security in tough environments.

The no-turning-back point

The momentum, however, seems unstoppable. With 2 billion passkeys in the wild and major platforms all-in, we’re past the early adopter phase. Shikiar’s goal of 5-10 billion feels like the “no turning back” threshold he mentions. The benefits are too compelling for businesses that lose real money to cart abandonment and support calls. Basically, passkeys are winning because they finally align security with user experience—you get better protection *and* a faster login. That’s a rare win-win in cybersecurity. The remaining challenges aren’t about *if* passkeys become the standard, but how quickly the industry irons out the sync risks and cross-platform wrinkles. The era of the one-time code is ending. Not with a whimper, but with a cryptographic key pair.