Do Passkeys Solve the Account Recovery Problem?
summary
Passkeys improve login but do not eliminate account recovery: synced passkeys reduce device loss risk yet users still lose access and cross‑device sync fails. Case studies: Cloudflare uses email, active sessions and a 3–5 day waiting period; GitHub falls back to OTPs and SSH keys and may withhold usernames for six months; Home Depot/Target use SMS or passwords; LinkedIn accepts government ID. One customer reports backup codes supply ~1% of weekly authentications. Recommendations: require multiple registered methods and add delays for high‑value accounts.
AI-written summary · about
chapters (8)
- 0:00Session introduction
- 1:15The account recovery problem
- 3:22Understanding fallback risks
- 6:41The state of passkey adoption
- 8:52Industry case studies
- 13:28Categorizing recovery methods
- 18:20Strategic recommendations
- 23:10Closing thoughts
related talks
31mAuthentication Afterlife: the dark side of making lost password recovery harder
14mThe challenges of account recovery
26mDesigning consumer account recovery in a 2FA world
24mRelying Party Security
30mAuthentication for humans, why passkeys finally make sense.
52mPasswords are Dead, Long live Passkeys!
24mPasskeys and digital identity best practices
37mAuthentication in 2026: A guide to passkeys, digital credentials and more