NEW YORK — What happened: Organizations globally are rapidly deprecating SMS and app-based time-based one-time passwords (TOTP) in favor of FIDO2-compliant hardware-bound passkeys, driven by new regulatory cybersecurity baselines introduced this year.
Why it matters: Traditional multi-factor authentication methods remain highly vulnerable to adversary-in-the-middle phishing kits that harvest login codes in real time. Hardware-bound passkeys tie cryptographic credentials directly to a trusted platform module (TPM) or security key, making credential theft practically impossible via standard phishing pages.
Deep dive: Passkeys use public-key cryptography. When a user registers with a service, a unique key pair is generated locally on their device. The private key never leaves the secure hardware enclave. During authentication, the server challenges the device to sign a cryptographic nonce. Because the domain name is baked into the signature request, a user visiting a spoofed phishing URL cannot successfully authenticate, even if they mistakenly enter their PIN or touch their biometric sensor.
Report check: Industry adoption surveys indicate a sharp drop in successful credential-stuffing attacks among firms that have completed the migration. However, edge cases regarding employee device loss, account recovery workflows, and cross-platform synchronization remain operational pain points.
Open questions: How will enterprises securely handle contractor onboarding when temporary workers lack corporate-issued hardware security keys? Will consumer adoption keep pace with enterprise mandates?