Passkeys moved the fight to your recovery flow

The password had a long, bad run. Reused, short, phished, leaked in bulk, reset badly. The passkey is the first control in years that removes a class of attack instead of shrinking it. The credential is a key pair, the private half never leaves your device, and the protocol binds it to the site's actual origin, so a convincing fake site gets handed nothing worth stealing. Phishing a passkey is pickpocketing a fingerprint: you walk away with a copy of nothing. That is a grudging compliment. I do not hand those out.

But an account is not its login screen. An account is login plus everything that gets you back in when login fails — and that everything is now the target.

Recovery is the real perimeter

Attackers do not pick the strongest door. They price every door and buy the cheapest one. Passkeys raised the price of the front door. Nobody at the other end stopped shopping. Walk the remaining doors:

• The phone number. You do not own your number; you lease it. A sim swap — a form, a bribe, a retail clerk having a bad afternoon — and the number that "proves" you is speaking for someone else.
• The security questions. Mother's maiden name, first street, first pet. These were never secrets. They are small talk from your hometown, now captioned under public photo albums. Worse, they never rotate: answer once, wear it forever, reuse it at every site that asks. One trivia breach and the answers leak together.
• The email account. Whoever owns the inbox owns the reset links for everything attached to it. It is the master key, and most people keep it under the doormat of a reused password.
• The support desk. A human with override authority and a verification checklist that a patient stranger with your address and last transaction can pass. In my experience the override console never appears in the architecture diagram. That is the point. It is the load-bearing wall nobody draws.

Price every door, then fix the cheapest

Threat-model your own reset flow the way an attacker would:

1. List every recovery path on your critical accounts, including the human one. You are allowed to know your own exposure — call and ask what they would need to reset you.
2. Kill what you can. Delete security questions, or fill them with random strings stored in your password manager. If a site insists on "real" answers, treat that as a policy bug and route around it.
3. Move recovery to something you hold: a spare hardware key in a drawer, or a passkey kept in your manager and synced to one device you control. One-time recovery codes go on paper, not in a photo album your phone backs up to someone else's disk.
4. Dedicate a recovery email used for nothing else — long unique passphrase, phishing-resistant second factor, no public footprint.
5. Assume the reset form gets filled in by someone who is not you. If it succeeds, the control failed, no matter how well the login screen behaved.

The lockout tax, and the grudging upside

Now the part I dislike admitting: every recovery path you cut makes lockout more likely, and lockout can be permanent. Availability is the forgotten leg of the triad. A control that locks you out of ten years of mail forever is a failure mode too — one that just pays out slowly. Size the trade like an adult. Hardened, redundant recovery for the accounts that matter; the recipe site can keep its questions.

One speculation, labeled as such: as passkeys spread, the pressure migrates to people. Support queues, recovery hotlines, the polite voice asking for the last four digits. The fallback protocol for the whole internet is a human having a mediocre day. Harden around that, and be civil to the person who checks — they are a security control too, and controls get exploited when they are rushed.

The login screen got better. The system did not. Trust nothing that can be reset with a phone call.