Authentication for humans, why passkeys finally make sense.

Authentication keeps failing because we still ask people to manage reusable secrets under pressure. Password managers, complexity rules, and MFA have improved security, but phishing, credential theft, and password reuse remain common causes of account compromise. This talk explains why password-based authentication fails structurally, not just because users make mistakes. It will examine the assumptions passwords make about human behaviour, why MFA often reduces but does not remove the problem, and how passkeys change the model. We will introduce passkeys as a human-centred redesign of authentication using public-key cryptography. By removing shared secrets and binding authentication to the legitimate site or application, passkeys reduce phishing risk while improving usability. Using real-world examples, we will explore how passkeys address two persistent failure modes: phishing attacks that bypass traditional MFA, and consumer account breaches caused by password reuse across services. We will also clarify the role of biometrics as a local unlock mechanism, not an authentication secret. Attendees will leave with a practical mental model of how passkeys work, why they are safer than passwords, and how individuals and developers can start adopting them using modern open web standards.