What happened: Major enterprise platforms and consumer cloud services have deprecated traditional password logins entirely in favor of passkeys stored in hardware enclaves and platform password managers. While security metrics have improved dramatically, user support desks are overwhelmed by account lockout scenarios.
Why it matters: Passkeys eliminate phishing and credential stuffing attacks entirely. However, for everyday consumers who do not understand cloud backup synchronization or hardware security keys, losing a phone often means permanent loss of digital identity access if recovery flows are misconfigured.
Deep dive: Passkeys rely on public-key cryptography tied to local device biometrics or a hardware token. The private key never leaves the device. The friction arises when moving between ecosystem boundaries—such as transitioning from an Android phone to a Windows PC—where seamless multi-device sync relies on third-party cloud trust brokers that casual users find confusing.
Report check (claims vs what is verified vs still rumor): Security firms report a 99% drop in unauthorized account access attempts. Industry marketing claims passkeys are totally transparent to users; verified user testing shows a 15% abandonment rate during initial multi-device enrollment.
Open questions: How can account recovery be made foolproof against social engineering without reintroducing vulnerable password backdoors?