Loading story…
Security experts are increasingly recommending the use of long, random passphrases over traditional complex passwords, emphasizing that password length provides significantly greater resistance to brute-force attacks. Passphrases composed of several unrelated words are easier for users to remember, reduce the likelihood of password reuse or insecure storage, and align with updated guidance from organizations like NIST, which now prioritize length over forced complexity.
Meanwhile, the adoption of passkeys—authentication methods based on public key cryptography—is gaining momentum as a more secure and user-friendly alternative to passwords. Passkeys eliminate the need for users to remember secrets and are resistant to phishing attacks, as authentication relies on cryptographic proof rather than shared secrets. While some skepticism remains due to marketing hype, the underlying technology offers substantial security benefits and represents a significant evolution in authentication practices.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
The Hacker News published an article titled 'Why You Should Swap Passwords for Passphrases,' reflecting broader security guidance to replace traditional passwords with stronger authentication secrets.
RunZero published a blog post arguing that passkeys generally improve authentication security through public-key cryptography and site-bound credentials, while warning that current enrollment flows and fallback password support create confusing and potentially risky user experiences.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Passwordless authentication methods are increasingly being adopted to address the security weaknesses of traditional passwords, which are often reused, forgotten, or stolen. Modern approaches such as passkeys and biometric authentication, including facial recognition and fingerprints, offer enhanced security and user convenience. Passkeys utilize public-key cryptography, where a private key remains securely on the user's device and a public key is shared with the service, making them resistant to phishing attacks. Biometric methods, like facial recognition, authenticate users based on unique physical characteristics, with the verification process occurring locally on the device. Despite misconceptions, passwordless authentication does not compromise security; instead, it often incorporates multi-factor elements by requiring both device possession and a unique user attribute, such as a fingerprint or PIN. These methods ensure that sensitive authentication data, like biometrics or PINs, never leave the device, significantly reducing the risk of credential theft. As organizations and users transition away from passwords, understanding the distinctions and strengths of passkeys and biometric authentication is essential for implementing secure and user-friendly access controls.
Jul 12, 2026
Passkeys are emerging as a modern alternative to traditional passwords, offering a more secure and user-friendly authentication method by leveraging cryptographic key pairs tied to user accounts. Unlike passwords, passkeys are resistant to phishing attacks and cannot be easily stolen or reused, as they are typically stored locally on a user's device and accessed through biometric or device-based authentication. Major organizations and technology providers, including those aligned with the FIDO Alliance, are promoting passkeys as a next-generation security solution. However, the implementation of passkeys introduces new considerations, particularly regarding how they are stored and synchronized across devices. There are two primary types of passkeys: device-bound, which remain on a single device or hardware security key, and synced passkeys, which are stored in consumer cloud services such as iCloud or Google Cloud and synchronized across multiple devices for convenience. While synced passkeys improve usability and account recovery for consumers, they introduce significant security risks for enterprises. If an attacker compromises a user's cloud account or abuses account recovery processes, they can authorize new devices and gain access to enterprise resources, undermining the integrity of the authentication system. Additionally, if employees use personal cloud accounts on corporate devices, passkeys may be inadvertently synced outside the organization's security perimeter, greatly expanding the attack surface. Attackers can also exploit help desk and account recovery workflows to copy protected keychains to unauthorized devices. Furthermore, adversary-in-the-middle (AiTM) attacks and malicious browser extensions can manipulate WebAuthn requests, force authentication fallbacks, and potentially leak credentials or one-time codes. Security experts and organizations such as the FIDO Alliance and Yubico recommend that enterprises mandate device-bound passkeys, preferably stored on hardware security keys, to maintain higher assurance and administrative control. Enterprises evaluating passkey deployments must carefully assess the risks associated with synced passkeys and implement policies that restrict their use in favor of more secure, device-bound alternatives. The adoption of passkeys should be accompanied by robust administrative controls, user education, and careful integration with existing identity and access management systems. Organizations must also review and strengthen their help desk and account recovery procedures to prevent attackers from exploiting these channels. As passkeys become more widely adopted, ongoing vigilance and adaptation of security practices will be essential to fully realize their benefits while minimizing new risks. The transition to passkey-based authentication represents a significant shift in enterprise security strategy, requiring both technical and operational adjustments. Ultimately, the effectiveness of passkeys in protecting enterprise assets depends on thoughtful implementation and a clear understanding of the associated risks and mitigations.
Jun 29, 2026
Enterprises are increasingly adopting passwordless authentication methods such as biometrics, passkeys, and security keys to enhance security and reduce the risks associated with traditional passwords. However, widespread implementation remains difficult, particularly for legacy systems, operational technology, and specialized applications that were never designed for anything other than passwords. Security leaders report that while most organizations can cover the majority of their threat landscape with passwordless solutions, the final 15%—often the most critical and legacy-dependent systems—remains resistant to change, creating operational and security challenges. Major technology providers like Google are actively promoting passwordless authentication, urging users to adopt passkeys and stronger authentication tools in response to increasingly sophisticated phishing and vishing attacks. Despite these efforts, the transition is hampered by technical, operational, and user experience hurdles, and attackers are exploiting gaps between multiple authentication systems. The push for a passwordless future is ongoing, but experts caution that full adoption may never be realized, and organizations must remain vigilant against evolving credential-based threats.
Jul 12, 2026