Consumer Privacy
Passkeys are winning, and account recovery is the hard part
Sign-in without a shared secret removes the largest category of account theft. The remaining weak point is what happens when a person loses their devices.
Updated 6 min readqikfox
The short answer
Passkeys remove the reusable secret that phishing and credential stuffing depend on, which is why adoption has moved quickly. The unsolved part is recovery: most services still fall back to email or a phone number, and that fallback is now the weakest link in an otherwise strong system.
Key points
- There is no password to steal, reuse or be tricked into typing.
- A passkey is bound to the site it was created for, which defeats look alike domains.
- Recovery paths inherit all the weakness the sign-in method removed.
- Two independent ways back into an important account is the practical minimum.
Why this actually helps
A password is a secret you can be persuaded to hand over. A passkey is a key pair where the private half never leaves your device and the browser will only use it on the exact site it was registered for. A convincing fake page cannot collect anything usable.
That closes the two dominant routes into consumer accounts: phishing, and reuse of a password exposed in someone else's breach.
Where the weakness moved
Attackers go to whatever is weakest, and for most services that is now recovery. If losing a device means a code sent to an email address protected by a password, then the account is only as strong as that email account.
Phone number based recovery is worse, because transferring a number away from its owner remains achievable and the person affected usually finds out after the fact.
- Add at least two passkeys on separate devices for important accounts.
- Protect the email account used for recovery at least as strongly as everything it can reset.
- Prefer recovery codes stored offline over a phone number where the choice exists.
- Check what recovery methods are actually enabled, not what you assume.
Synced or device bound
Passkeys synced through a password manager or platform account are far easier to live with and mean a lost phone is not a lost account. The trade off is that the sync account becomes a high value target.
Device bound keys, including hardware keys, give the strongest guarantee and demand that you plan for loss. For most people, synced keys plus a hardware key as a second factor on the most important accounts is a reasonable balance.
What to do this month
Turn on passkeys for your email, your primary identity account and anything holding money. Those three cover most of the damage anyone could do.
Then go and read the recovery settings on each one. That step is the one people skip, and it is where the remaining risk lives.
Questions and answers
Related qikfox pages
Passwords that hold up
For the accounts that still need one.
Recognising phishing pages
The habit passkeys make less critical.
Privacy at qikfox
Our approach to personal data.
Security Center
Advisories and notices.
Back to The Perspective · Written and reviewed by the qikfox editorial team. Published .
Put the advice into practice
qikfox Safe Browser applies most of what this article describes by default, and works alongside qikfox Search, Antivirus and VPN.