Way Too Much Information
Passkeys, Passwords, and the Problem of Proving Who You Are
A practical, non-hyped guide to passwords, MFA, passkeys, recovery, and the identity questions a midsize organization should answer before changing sign-in technology.
On this page
The short version
Authentication is the process of deciding whether a person, device, or service is allowed to act as a particular identity. Passwords are one way to do that. MFA adds another factor. Passkeys change the underlying exchange so that the service does not need to receive a reusable secret in the ordinary login flow.
The important business question is not which word is newest. It is whether the organization can control identity from enrollment through recovery and removal.
Why passwords remain difficult
Passwords are easy to explain and difficult to manage at scale. They are copied, reused, guessed, phished, written down, and forgotten. The problem is not that every employee is careless. The problem is that a shared secret is a poor long-term representation of a person’s authority.
What MFA changes
MFA requires more than a password. CISA recommends requiring MFA wherever possible and aiming for phishing-resistant methods when available. CISA also distinguishes among security keys, authenticator apps, biometrics, and codes delivered by text or email.
That hierarchy matters because a second factor can still be exposed to persuasion or interception. MFA reduces risk, but “MFA enabled” does not describe the quality of the factor or the recovery process.
What passkeys change
FIDO describes passkeys as a passwordless sign-in method built around cryptographic credentials. In broad terms, a device creates a key pair; the service stores a public key, while the private key remains protected by the user’s device or credential manager.
This changes the phishing problem because a passkey is tied to the legitimate service context rather than being a string a person can be tricked into typing into a look-alike page.
The recovery problem remains
No sign-in system eliminates recovery. Phones break. Employees replace devices. People lose access to accounts. A business that adopts a stronger sign-in method without designing recovery may simply move the weak point.
Document who can recover an account, what evidence is required, how emergency access is logged, and how access is removed when employment or vendor relationships end.
A small-business adoption sequence
- Inventory the systems that matter and identify their administrators.
- Require strong MFA for privileged and high-impact accounts.
- Document recovery before changing the sign-in method.
- Pilot passkeys with a small group and record the exceptions.
- Review shared accounts, service accounts, and vendor access separately.
- Test offboarding and emergency recovery.
Glossary
Authentication: proving an identity. Authorization: deciding what that identity may do. Phishing-resistant: designed to remain bound to the legitimate sign-in context. Recovery: restoring access without casually bypassing the security control.