07/14/2026
"Amazon and all kinds of websites are trying to get me to change to passkeys instead of passwords. Should I use those "passkeys" to login to everything?"
Yes. And I couldn't have given a better explanation than this (from Ai):
Passkeys are one of the rare security upgrades that's both more secure *and* more convenient. Turn them on for your important accounts (Google, Apple, banks, Microsoft), but keep a backup sign-in method until you're comfortable.
# # What a passkey actually is
A passkey replaces your password with a cryptographic key pair. When you set one up, your device (phone, laptop, or password manager) creates two mathematically-linked keys: a **private key** that never leaves your device, and a **public key** the website stores.
When you log in, the website sends your device a random challenge, your device signs it with the private key (after you unlock it with your fingerprint, face, or PIN), and the website verifies the signature with the public key. The secret itself is never transmitted, never typed, and never stored on the website's servers.
Plain-English analogy: a password is like a shared secret handshake — you and the website both have to know it, and anyone who overhears it can impersonate you. A passkey is like a signature stamp that only exists in your pocket. The website only keeps a sample to compare against. Stealing the website's copy is useless — you can't forge the stamp from the sample.
# # Why security people like them
**Phishing-proof.** This is the big one. A passkey is cryptographically bound to the real website's domain. If you land on `paypa1-login.com` instead of `paypal.com`, your passkey simply won't work there — there's nothing to trick you into typing. Phishing is the #1 way normal people get compromised, and passkeys kill it almost entirely.
**Nothing to steal in a breach.** When a company gets hacked and their password database leaks, your password (or its hash) is exposed. With passkeys, all they have is your public key, which is useless to an attacker.
**No reuse problem.** Most people reuse passwords. One leaked password gets tried against your email, bank, everything. Passkeys are unique per site by design — you can't reuse them even if you wanted to.
**Your fingerprint/face never leaves your device.** The biometric only unlocks the key locally. The website never sees it.
# # The honest cons
**Account recovery is the weak point.** If you lose all your devices and you're locked out of your Apple/Google account that synced your passkeys, recovery can be painful. This is the real risk for regular people — not hackers, but self-lockout.
**Ecosystem lock-in friction.** Passkeys sync within an ecosystem (iCloud Keychain for Apple, Google Password Manager for Android/Chrome). Living across Apple + Windows + Android works but has rough edges — sometimes you're scanning a QR code with your phone to log in on a PC, which feels clunky. A cross-platform password manager (1Password, Bitwarden) that stores passkeys smooths this out.
**Uneven rollout.** Some sites support passkeys fully, some only as a second factor, some not at all. You'll be living in a hybrid password/passkey world for years.
**Shared accounts get awkward.** Sharing a Netflix password with family is trivial. Sharing a passkey is harder (though password managers can do it).
**Most sites keep the password as fallback.** Here's the fine print nobody mentions: if the site still lets you log in with your old password, an attacker can too. The passkey only closes the phishing door completely once the password fallback is removed or the account is otherwise hardened. It's still a big win — *you* stop typing your password places — but it's not absolute until sites let you go passwordless entirely.
# # What I'd tell you to do as your consultant
1. **Do now:** Add passkeys to your Google account and Apple ID (whichever you use). These are the keys to everything else.
2. **Do next:** Add them to financial accounts and your business email as sites offer them. Keep a strong password + authenticator app as backup on each.
3. **Later:** As you trust the workflow, consider a password manager that handles passkeys so you're not locked to one ecosystem. And make sure your account recovery info (backup email, phone) is current — that's your real safety net.
Bottom line: passkeys move the security burden from "did the human pick a good secret and avoid getting tricked" to "does the human physically possess their device." That's a trade every security person will take, because humans are bad at secrets and pretty good at holding onto their phones.
"...humans are bad at secrets and pretty good at holding onto their phones." 😀
Send a message to learn more
