https://nalar.dev/tags/webauthn/ Recent content in WebAuthn on Nalar Hugo en-us Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/passkeys-change-the-shape-of-account-recovery-risk/ Sat, 12 Sep 2026 00:00:00 +0700 https://nalar.dev/passkeys-change-the-shape-of-account-recovery-risk/ <p>Passkeys can make the primary sign-in path markedly harder to phish while leaving an older recovery path almost untouched. That asymmetry matters. An account protected by a device-bound or synced passkey may still accept a password reset through email, a support-assisted identity check, or a fallback factor with weaker resistance to social engineering.</p> <p>The result is not a flaw in passkeys. It is an architectural shift: once routine authentication stops depending on a reusable secret, attackers have more incentive to target the mechanisms that restore access after credentials are unavailable. Security teams that evaluate only the sign-in ceremony can miss the route that now carries much of the residual account-takeover risk.</p>