Topic starter
08/02/2026 9:40 pm
TL;DR: Passkeys replace passwords with phishing-resistant public key authentication, and Okta cites customer-identity survey data showing 33% of respondents are frustrated by password creation while 63% cannot log in at least monthly because they forget credentials. The security case is clearer than the UX case: authentication friction remains a governance problem, not just a usability one.
Editorial analysis by NHI Mgmt Group, based on content published by Okta: “Passkeys 101: What they are and how they will replace passwords”.
Key questions
Q: How should CIAM teams implement passkeys without breaking account recovery?
A: Treat recovery as part of the authentication design, not an afterthought.
Q: Why do passkeys reduce phishing risk compared with passwords?
A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret.
Q: What are the signs that passwordless login is improving customer experience?
A: Watch for higher login success, fewer password reset requests, lower abandonment during sign-up, and fewer repeated support contacts tied to forgotten credentials.
Practitioner guidance
- Map password-heavy journeys first Identify customer login, reset, and registration flows where password friction creates abandonment or repeated recovery events.
- Design a passkey recovery path Define how customers regain access when a device is lost or replaced, including fallback authentication, re-enrolment, and support verification.
- Separate device trust from credential trust Treat device-bound and synced passkeys as different control models and document where each is allowed.
Bottom line: Password-based customer authentication remains a friction point as well as a security risk, so the case for change is operational, not just cryptographic.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:19 pm
Passwordless is now an identity governance issue, not just a usability upgrade. The article’s numbers show that password frustration and login failure remain common enough to affect both customer experience and security posture. Once authentication becomes a conversion problem and a support problem, the control conversation moves beyond password policy into how CIAM programmes govern access without shared secrets. The practitioner implication is that authentication design and identity governance can no longer be separated.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should security teams do when customers still rely on passwords?
A: Use the remaining password journeys to identify where friction, reset volume, and phishing exposure are concentrated. Then prioritise those flows for phased passwordless migration, starting with the highest-volume customer paths and the accounts that create the most support or fraud risk.
👉 Read our full editorial: Passkeys shift customer authentication away from password risk