Topic starter
11/07/2026 1:54 pm
TL;DR: Passkeys materially improve phishing resistance by keeping the private key on the device and proving possession without transmitting the secret, according to GlobalSign. Identity teams still have to govern enrolment, recovery, revocation, and audit evidence across linked services.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Passkeys vs. Passwörter: Worin liegt der Unterschied?”.
Key questions
Q: How do passkeys affect identity governance and lifecycle controls?
A: Passkeys shift governance from password policy toward device enrolment, recovery, revocation, and auditability.
Q: What are the signs that password-based authentication is becoming unsustainable?
A: Warning signs include frequent resets, heavy help desk burden, widespread password reuse, weak password hygiene, and repeated phishing exposure.
Q: How should organisations decide whether to prioritise passkeys over passwords?
A: Organisations should prioritise passkeys when they want stronger authentication with less user friction and a cleaner path toward passwordless access.
Practitioner guidance
- Inventory authentication dependencies by application Map where passwords, passkeys, SSO, federation, and certificate-based authentication are actually used so migration decisions reflect real control paths, not user preference alone.
- Define passkey recovery and device-loss procedures Specify how new devices are enrolled, how lost devices are handled, and how revoked access is removed from linked applications and sessions.
- Rework audit evidence for cryptographic sign-in Update logging and review processes so authentication evidence focuses on enrolment, device binding, and revocation events rather than password change cadence.
Bottom line: Passwords remain a structural liability because they depend on reusable secrets, human behavior, and support-heavy recovery workflows.
Glossary terms: Passkey, Passwordless Authentication, Public Key Infrastructure, Federated Authentication
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
11/07/2026 2:05 pm
Reusable secret authentication is the real governance debt: Passwords fail not only because they are weak, but because they embed a reusable-secret model into every downstream control. That model encourages reuse, reset workflows, and support overhead that scale badly in large enterprises. Identity programmes that keep treating password risk as a user habit problem miss the architectural issue. The practical conclusion is that authentication design, not user discipline, is the control boundary that matters.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What should teams do when passkeys are not supported everywhere yet?
A: Use a hybrid model and separate the systems that can absorb passkeys from the ones that still require passwords or other federated methods. Keep the migration scoped to the applications, user groups, and recovery workflows you can govern end to end, and avoid a broad rollout that leaves support and compliance gaps.
👉 Read our full editorial: Passkeys sharpen enterprise identity controls beyond password policy
This post was modified 7 hours ago by NHI Mgmt Group