Topic starter
09/12/2025 12:28 pm
TL;DR: Teleport reports that passkeys for infrastructure use WebAuthn, device-bound keys and proximity proof to make phishing harder, but synced passwordless access across devices can widen identity sprawl and exception handling overhead. The control problem shifts from password reuse to governance of where passwordless access is registered, stored and allowed to operate.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “Passkeys for Infrastructure”.
Key questions
Q: How should security teams adopt passkeys for infrastructure access?
A: Start with the highest-risk interactive accounts, especially administrators who are exposed to phishing and push fatigue.
Q: Why do passkeys still need identity governance if they are phishing-resistant?
A: Because phishing resistance solves one failure mode, not the whole identity problem.
Q: What breaks when passkeys are used without endpoint governance?
A: Passkeys can still authenticate the wrong endpoint if organisations do not control device provenance.
Practitioner guidance
- Define approved passkey enrollment paths Restrict passkey enrollment to managed devices and documented recovery workflows so that synced credentials do not bypass existing access approval processes.
- Map every fallback login method Inventory terminals, unsupported browsers and emergency access paths, then decide which security key or passwordless fallback is permitted for each case.
- Track device scope for each identity Record which phones, laptops and browsers can authenticate with the same passkey so offboarding removes every active trust point, not just the primary device.
Bottom line: Passkeys make infrastructure logins more resistant to phishing, but they do not remove the need for identity governance.
What's in the full article
Teleport's full blog post covers the implementation detail this post intentionally leaves for the source:
- Step-by-step passkey enrollment guidance for Teleport environments
- Platform-specific notes on iOS 16, Ventura, Windows 11 and browser support
- Terminal access limitations and when a USB security key is still recommended
- Practical setup steps for enabling WebAuthn and adding a second factor device
👉 Read Teleport's analysis of passkeys for infrastructure access →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 2 times by Abdelrahman
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 6:34 pm
Passkeys solve the phishing problem, but they do not solve identity lifecycle governance. The article shows a stronger authentication factor, yet the underlying administrative burden does not disappear. Once access is tied to synced devices and multiple enrollment paths, the programme still has to govern who can register, recover and retire those credentials. The practitioner conclusion is that authentication hardening and lifecycle control must be designed together.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What is the difference between passkeys and traditional MFA for infrastructure?
A: Traditional MFA usually adds a second step to a password flow, while passkeys replace the password with cryptographic authentication bound to the device and user verification. That makes passkeys more resistant to phishing, but it also shifts control effort toward device enrollment, sync policy and recovery management.
👉 Read our full editorial: Passkeys for infrastructure reduce phishing risk, but not NHI sprawl