NEW YORK — What happened: Security audits released this quarter show that enterprise and consumer adoption of passkeys—cryptographic, phishing-resistant credentials stored locally on devices—has finally surpassed legacy password-plus-SMS workflows across major cloud identity providers.
Why it matters: Passkeys eliminate the human element of credential theft. Because they rely on public-key cryptography bound to a specific domain and verified via biometric sensors, attackers can no longer harvest them through traditional phishing websites or social engineering.
Deep dive: When a user creates a passkey, their device generates a unique cryptographic key pair. The public key is stored safely on the service provider's server, while the private key remains secure inside the device's hardware enclave (such as a Trusted Platform Module or Secure Enclave). When logging in, the server challenges the device to sign a random nonce using the private key. If the user's fingerprint or face unlocks the private key, authentication succeeds without any secret ever traveling across the network.
Report check (claims vs what is verified vs still rumor): Cybersecurity firms verify a sharp drop in account takeover incidents for platforms that enforce passkeys. Claims that SMS-based two-factor authentication is now an active security vulnerability are backed by telecom standards bodies deprecating SS7 signaling security protocols.
Open questions: What happens when a user loses all trusted devices synced to their passkey ecosystem? How can organizations manage cross-platform account recovery without reintroducing weak fallback verification methods?