Authentication continues to fail not because users ignore security advice, but because the systems we built require humans to manage reusable secrets under pressure. Despite decades of improvements such as password managers, complexity rules, and multi-factor authentication, phishing and credential theft remain the most common causes of account compromise.

This talk starts by examining why password-based authentication fails at a structural level. We will look at the assumptions passwords make about human behaviour, why those assumptions break down in real-world use, and why layered controls like MFA often add friction without eliminating core failure modes.

From there, we will introduce passkeys as a human-centred redesign of authentication rather than another security add-on. We will explain what passkeys are, how they work using public-key cryptography, and why removing shared secrets fundamentally changes the security model while improving usability at the same time.

Using two real-world examples, we will explore why passkeys succeed where passwords struggle. First, we will examine phishing attacks that bypass traditional MFA by exploiting user trust and show how passkeys remove the need for users to identify real login pages through cryptographic origin binding. Second, we will look at common consumer account breaches caused by password reuse across services, and how passkeys prevent cross-site compromise without increasing cognitive load.

Attendees will leave with a clear mental model of how passkeys work in practice, including the role of biometrics as a local unlock mechanism rather than an authentication secret. We will conclude with practical guidance on how individuals can start using passkeys today, and what developers need to consider when adding passkey support to their own applications using modern, open web standards.