GoKawiilOpinion: Passkeys solve phishing but raise the risk of permanent account lockout
A tech commentator argues that while Big Tech companies like Google and Microsoft are aggressively pushing users toward passkeys, the technology trades one security risk for another. Passkeys eliminate phishing by binding logins to a specific site, but because they can't be backed up or transferred between hardware keys, users face a higher chance of losing access entirely if devices are lost or accounts are banned.
GoKawiil's interpretation of the reporting above, not reported fact.
Passkeys were built to solve enterprise-grade threats like man-in-the-middle attacks, but everyday users care more about not getting locked out of their accounts than defeating sophisticated hackers. Account security still hinges on fallback methods like SMS and email recovery, so the industry's push toward passwordless logins may be overselling a solution mismatched to individual needs, and forcing users to buy multiple costly hardware keys just to stay protected.
- Passkeys prevent phishing but cannot be backed up or moved between hardware keys once created.
- Account recovery methods like SMS and email remain the weakest link, undermining passkey security benefits for individuals.
- Big Tech firms are steering users toward passwordless setups despite passkeys being better suited to corporate rather than personal use.
YubiKey 5C NFC Security Key — If you're wary of relying solely on device-bound passkeys, a hardware security key like the YubiKey gives you a portable, durable backup for your passkeys and two-factor authentication. It works across many services and platforms, so you can keep phishing-resistant login security without worrying about losing access if your phone dies. It's a practical way to hedge against the account lockout risks discussed in the article.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: hawksley.dev — Ethan Hawksley, 2026-09-18
Published there as: “I don't like passkeys”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.