Home

Podfeet Podcasts

Security Bits logo - a green padlock with the words Security Bits to the right and in tiny letters below ithat it says 10101010 indicating a digital lock

Security Bits — 15 March 2026

  • by Bart Busschots

    • Feedback & Followups

    Listener Questions

    Passkeys Question From Ed Tobias

    Ed ask if it’s possible for passkeys to replace passwords completely given passkeys are device-bound, and we need to be able to renew our devices?

    TL;DR — Yes!

    Fundamentally, authentication and account recovery are two completely different problems, and always have been. Replacing your device and hence losing the passkeys on it is similar to forgetting your passwords. Similar, but actually a slightly easier problem to solve in many situations.

    No matter how you authenticate, it’s always possible to get locked out, so there has always been a mechanism for getting back in, and there always will be. That mechanism is completely separate from how you authenticate, and the details depend entirely on the context. Some example processes include:

    1. Websites often use an email loop to recover accounts
    2. Cellphone-number-based messaging apps like Signal, Telegram, and WhatsApp use an SMS loop
    3. Banks often require you to visit a branch with photo ID
    4. Organisations often require you to visit IT with your work or student ID

    Passkeys don’t change any of this. But, passkeys do offer some nice simpler yet equally secure additional options for onboarding new devices that don’t yet have a needed passkey.

    For example, if you use Entra ID (Microsoft’s identity provider for the work/school versions of Office365), a short-lived temporary access pass (TAP) can be given to the user by the service desk to allow them register a new passkey. These TAPs can be configured with very short lifetimes, and to be single-use.

    However, because we generally have more than one device these days, you can often handle the need for a new passkey without needing to resort to account recovery at all, simply by using a device that does still have a valid passkey to securely authorise the generation of a new passkey on the new device. There are infinitely many ways to implement this concept, but here are some examples I seen in the real world:

    1. Using a passkey manager that synchronises passkeys securely between devices, for example, 1Password (how I manage all my passkeys that are not device-bound by corporate policy).
    2. Presentation of a QR code on an existing device to be scanned by the new device to authorise the creation of the new passkey.
    3. Generation of a one-time code on a logged in device with a existing passkey to authorise the creation of a new passkey on a new device.

    So, in short, neither the need for device replacements nor the need for account recovery prevent the complete death of passwords in the hopefully near future 😀 Thank goodness!

    ❗ Action Alerts

    Worthy Warnings

    Notable News

    Palate Cleansers

    Legend

    When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    📊 A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
    💵 A link to an article behind a paywall.
    📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.
    🎦 A link to video content.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top