Passkeys and MFA: The End of Passwords?

Passwords have been security's weakest link for 30 years. Reused, stolen through phishing, exfiltrated in breaches, cracked by brute force. Traditional MFA (SMS, TOTP) improves the situation but remains vulnerable. In 2026, passkeys and phishing-resistant authentication are finally changing the game.

Understanding FIDO2 and Passkeys

FIDO2: The Standard

FIDO2 is the authentication standard developed by the FIDO Alliance and W3C. It relies on public key cryptography: a private key stays on your device, never transmitted to the server. Authentication uses cryptographic challenge-response, eliminating shared secrets.

Passkeys: FIDO2 for Everyone

Passkeys are the consumer-friendly implementation of FIDO2. The major difference from hardware security keys (YubiKey): passkeys sync across your devices via the cloud (iCloud Keychain, Google Password Manager, Windows Hello). The user experience is finally smooth:

• No password to remember

• Biometric authentication (fingerprint, Face ID) or local PIN

• Native phishing resistance (passkey is bound to the domain)

• No server-side secret to steal

Why Traditional MFA Is No Longer Enough

MFA Fatigue: The Attack That Works

MFA fatigue (or MFA bombing) involves flooding a user with push notifications until they accept out of exhaustion or by mistake. This is how Uber and Cisco were compromised in 2022. Push notifications alone are not phishing-resistant.

Real-Time Phishing (AitM)

Modern phishing kits (EvilGinx, Modlishka) intercept MFA tokens in real-time via adversary-in-the-middle proxies. The user enters credentials and TOTP code on a fake page, the attacker replays them immediately on the real site. TOTP and SMS do not protect against this attack.

SIM Swap

SMS-based MFA is vulnerable to SIM swap: the attacker convinces the carrier to transfer the number to a new SIM. NIST has discouraged SMS as an authentication factor since 2017.

Phishing-Resistant Authentication

Authentication is considered phishing-resistant when it cannot be replayed or intercepted, even if the user is redirected to a malicious site. Only two technologies qualify:

• FIDO2/Passkeys: the private key never leaves the device, authentication is domain-bound (origin binding)

• Client certificates (mTLS): X.509 certificate authentication bound to the device

Deploying Passkeys in the Enterprise

• Step 1: inventory your applications and their FIDO2 support. Major identity providers (Entra ID, Okta, Google Workspace) natively support passkeys

• Step 2: deploy in hybrid mode (passkey + password fallback) for pilot users

• Step 3: progressively eliminate passwords for compatible user groups

• Step 4: enforce phishing-resistant MFA for critical access (admin, VPN, production)

ThreatClaw monitors suspicious authentication attempts and detects MFA fatigue and AitM attacks. Our security platform integrates with your existing identity providers. Discover our expertise and plans.

FAQ

Will passkeys completely replace passwords?

Eventually, yes. In 2026, most major services (Google, Microsoft, Apple, GitHub) support passkeys. Full transition will take another 3-5 years for legacy enterprise applications.

What happens if I lose my device?

Synced passkeys are backed up in the cloud (iCloud, Google). For hardware keys, you need to register a backup key. In enterprise settings, recovery procedures must be planned.

Are passkeys truly phishing-resistant?

Yes. The passkey is cryptographically bound to the site's domain. If the user is redirected to a fake site, the passkey simply does not activate. It is transparent and automatic protection.

Is TOTP (Google Authenticator) still recommended?

TOTP is better than SMS but remains vulnerable to real-time AitM attacks. For critical access, prefer FIDO2/passkeys. TOTP remains acceptable as a secondary factor for moderate-risk applications.