Passkeys Are Great. They Still Ask.

Let's get this out of the way first: passkeys are good. Really good. If your organization is rolling them out, keep going. We're not here to talk you out of them. (In fact, we use them in our authentication process when you don't have another device nearby, or if we determine the need for extra authentication.)

We get asked about passkeys in almost every conversation now — usually some version of "We're moving to passkeys. Why would we need anything else?" It's a fair question, and the honest answer is that passkeys solve one specific problem extremely well. The trouble is that it isn't the only problem.

What passkeys actually fixed

A passkey replaces your password with a cryptographic key pair. The private key stays on your device, protected by your fingerprint, face, or PIN. The public key sits with the website. When you log in, your device proves it holds the private key — and nothing reusable ever crosses the wire.

The clever part is that each passkey is bound to the exact website it was created for. That's what makes t hem phishing-resistant. Remember the adversary-in-the-middle attack, where a fake login page quietly relays your password and your MFA code to the real site? It doesn't work against a passkey. Your device looks at the domain, sees it isn't the real one, and simply refuses to sign in.

No password to steal. No code to relay. No push notification to spam. That's a massive improvement, and it's why every major platform is pushing passkeys hard.

The part passkeys don't cover

Here's the catch. A passkey answers one question, one time: is the right person logging in right now? Once the answer is yes, the website hands you a session — and from that moment on, the passkey is out of the picture. Everything after the login runs on that session, exactly the same way it did with passwords.

That leaves three very familiar gaps wide open.

1. The stolen session

Infostealer malware doesn't care how you logged in. It grabs the session cookie your browser is already holding and ships it off to an attacker, who drops it into their own browser and picks up right where you left off. Your passkey login was flawless. It just doesn't matter anymore. We covered this in detail in Your MFA Worked. You Got Hacked Anyway. — and a passkey is still MFA in that story.

2. The walk-away

You sign in with a passkey at 9:00. At 9:40 you go to a meeting and leave your laptop unlocked. The passkey has no idea you left. Your session is still open, still trusted, and available to whoever sits down next — until an idle timer eventually kicks in.

3. The shared device

Nurses' stations, retail registers, factory floors, call centers. These are places where several people use the same workstation over a single shift, often in quick succession. Passkeys are built around personal devices. On a shared terminal, people either skip logging out (because logging in again is a hassle) or the organization falls back to a shared account. Either way, you've lost track of who's actually at the keyboard.

And one more: the way back in

Every passkey rollout needs an answer for "I lost my phone." In a lot of organizations, that answer is still a text message, an email link, or a call to the help desk. A passkey is only as strong as the recovery path behind it, and attackers know it. If they can't phish the passkey, they'll phish the reset.

Passkeys and presence: two layers, not two rivals

This is why we don't see passkeys as competition. They're the right answer to "who is logging in?" NearAuth.ai is built to answer the question that comes next: is that person still here?

NearAuth.ai continuously checks proximity between a person and their trusted devices throughout the session, not just at the start. Walk away and the workstation locks. Come back and you're in, without tapping anything. A copied session cookie doesn't help an attacker on another continent, because they can't put your phone next to their keyboard. And on a shared terminal, access follows whoever is actually standing there.

So yes, use passkeys. They make the front door much harder to break. Just don't mistake a better lock on the front door for knowing who's still in the building.

---

Related reading: why identity needs to go beyond the front door, and how session hijacking lets attackers skip your login entirely.