Passkeys beat phishing, but you still need a recovery plan

For small businesses, a synced passkey is generally the better default than a strong password plus a code or push MFA when phishing is the main concern. The UK NCSC finds FIDO2 resistant to the adversary-in-the-middle phishing that can defeat traditional MFA. But the choice depends on what happens outside the normal sign-in. Someone who can unlock your device, gain access to the account that synchronizes your passkeys, or abuse a weak recovery route may still reach the account. Losing access to your only device can also make getting back in harder. Those dependencies matter for consumers and for small businesses choosing how staff sign in.

The UK NCSC notes that FIDO2 technology, which powers passkeys, is resistant to the type of phishing that defeats traditional codes. A passkey uses a private key on your device and a public key on the service. The fake site can’t steal what it can’t see. This makes it a stronger default than a password plus a code or push approval for any account that supports it.

Here’s the catch. Passkeys don’t protect a device that’s already compromised by malware or a malicious browser extension. Researchers have shown that if an attacker controls the device or alters browser trust settings, they can still bypass these protections. The passkey stops the fake page, not the infected computer. (FIDO Alliance)

You need to check your recovery options. If your service allows a password as a backup sign-in method, that route remains a target. Google Account Help explains that you can remove a passkey associated with a lost device, but you must ensure you have a secure way to get back in if you lose your only phone. Losing access to your primary email or credential manager can lock you out of everything else.

What to do this week

Enable passkeys for accounts that support them, especially for primary email or credential managers. Ensure you have a secure way to recover your account if you lose your device, such as a secondary enrolled device. Protect the account that synchronizes your passkeys with phishing-resistant sign-in, as it controls the route to restoring credentials.

We think this one’s overblown when it comes to panic, but underplayed when it comes to daily habits. Do the boring version of this and you’ll be fine. Check your recovery steps before you need them. It’s better to be annoyed now than locked out later.

Sources: Quasa.io.