Passkeys Are Better Than Passwords. But They Are Not Enough.
Summary
While passkeys offer a significant improvement over traditional passwords by reducing the attack surface, they are not a complete security solution. As organizations increasingly adopt passkeys, attackers will likely shift their focus to exploiting vulnerabilities surrounding the passkey ecosystem rather than targeting the passkeys themselves.
IFF Assessment
Passkeys represent a move towards more secure authentication methods, which is beneficial for defenders by reducing common attack vectors like password spraying and phishing.
Defender Context
The adoption of passkeys is a positive step towards stronger authentication, but defenders must remain vigilant. Attackers will seek new avenues, potentially targeting phishing for account takeover through other means or exploiting vulnerabilities in the systems that manage passkeys. Organizations should focus on comprehensive security strategies that go beyond just authentication.