Topic starter
11/07/2026 1:54 pm
TL;DR: Passkeys reduce phishing exposure by keeping the private key on the device and using public-key cryptography, while passwords remain vulnerable to reuse, brute force, and user fatigue, according to GlobalSign. The real decision is how authentication fits lifecycle, PKI, SSO, and compliance without widening operational blind spots.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Passkeys vs. Passwörter: Worin liegt der Unterschied?”.
Key questions
Q: How should organisations decide whether to prioritise passkeys over passwords?
A: Organisations should prioritise passkeys when they want stronger authentication with less user friction and a cleaner path toward passwordless access.
Q: How do passkeys affect identity governance and lifecycle controls?
A: Passkeys shift governance from password policy toward device enrolment, recovery, revocation, and auditability.
Q: What are the signs that password-based authentication is becoming unsustainable?
A: Warning signs include frequent resets, heavy help desk burden, widespread password reuse, weak password hygiene, and repeated phishing exposure.
Practitioner guidance
- Inventory authentication dependencies by application Map where passwords, passkeys, SSO, federation, and certificate-based authentication are actually used so migration decisions reflect real control paths, not user preference alone.
- Define passkey recovery and device-loss procedures Specify how new devices are enrolled, how lost devices are handled, and how revoked access is removed from linked applications and sessions.
- Rework audit evidence for cryptographic sign-in Update logging and review processes so authentication evidence focuses on enrolment, device binding, and revocation events rather than password change cadence.
Bottom line: Passwords remain a structural liability because they depend on reusable secrets, human behavior, and support-heavy recovery workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:05 pm
Reusable secret authentication is the real governance debt: Passwords fail not only because they are weak, but because they embed a reusable-secret model into every downstream control. That model encourages reuse, reset workflows, and support overhead that scale badly in large enterprises. Identity programmes that keep treating password risk as a user habit problem miss the architectural issue. The practical conclusion is that authentication design, not user discipline, is the control boundary that matters.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What should teams do when passkeys are not supported everywhere yet?
A: Use a hybrid model and separate the systems that can absorb passkeys from the ones that still require passwords or other federated methods. Keep the migration scoped to the applications, user groups, and recovery workflows you can govern end to end, and avoid a broad rollout that leaves support and compliance gaps.
👉 Read our full editorial: Passkeys and passwords: what changes for enterprise identity security