Topic
Passwordless login credentials using FIDO2/WebAuthn public-key cryptography, unlocked via biometric or PIN to resist phishing.
Dashlane's annual report counts 2.5 million passkey authentications a month, nearly double last year. Most logins at the biggest sites still use another method, so passwords and one-time codes stay in play.
Reality
Google began supporting Credential Exchange in Google Password Manager in June 2026, so Android apps can move passkeys without a CSV file. Businesses should confirm that notes and attachments arrived before retiring a manager, TechRepublic advises.
Reality
Sublime Security says calendar phishing is growing exponentially as apps like Google Calendar add invites automatically, even from emails sent to spam. That moves the defence from the mail filter to calendar settings and to what staff do with an unexpected meeting.
Reality
Yubico and Okta's survey of 1,890 tech and security professionals found 23% work where multifactor login is not required on every application. With 88% still rating their company secure, at least one respondent in nine gave both answers.
Reality
Yubico and Okta found 43% of 2,000 security professionals log in to work with passwords, while 25% use the hardware passkeys they rate most secure. The people surveyed already know which logins are weak, so closing the gap is deployment work for their employers.
Reality
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishersReality
The UK's Report Fraud service is urging the public onto passkeys after email and social media takeover losses rose to £6.3m in 2025/6 from £1.2m. The NCSC is backing the switch as a defence against phishing.
Reality
Reported losses to criminals who hijack UK email and social media accounts reached 6.3 million pounds in 2025-26, up from 1.2 million, police data shows. The base is small, but fraud that borrows a person's identity gives employers a reason to review how staff log in.
Reality
FIDO's export format for passkeys has only begun shipping in iOS 26 and Android, with the FIDO Alliance counting 5 billion passkeys in use. The key that makes them phishing-resistant cannot be copied off the device, so adopters need a plan for lost devices and changed managers.
Reality
The two-step secret becomes a full alphanumeric password, and an account can now hold one passkey per platform. Both remain opt-in settings inside the app.
Perspective Coverage
7 publishersReality
Dashlane's answer to employees drifting back to typed passwords is a per-domain block inside the browser extension. The work that decides whether it helps happens upstream, when an admin picks which login pages go on the list.
Reality
Microsoft has tracked intrusions since May in which callers posing as IT told employees a passkey update was due, then steered them to a phishing page or a device-code prompt. The enrollment step is where the chain starts.
Reality