Pass the key, passwords have passed their sell-by date
- Reference: 1776931208
- News link: https://www.theregister.co.uk/2026/04/23/ncsc_passkey_tech_now_reliable/
- Source link:
New official guidance states that passwords should not be used where passkeys are available, overturning decades of conventional advice. A technical report, released today at the NCSC's annual CYBERUK conference, concludes passkeys "are at least as secure as, and generally more secure than" a password and two-step verification (2SV) combo.
The agency had considered this move last year, but held off until some "implementation challenges" were addressed by the industry, [1]including inconsistent passkey naming across platforms, unreliable device support, and limited credential manager compatibility. Those gaps have since narrowed enough to act.
[2]
Google, eBay, and PayPal were named by NCSC as three major platforms that made it easier for users to adopt passkeys, with around 50 percent of UK Google users registering at least one. Microsoft made passkeys the default standard [3]nearly a year ago .
[4]
[5]
Where passkeys aren't available, the signals intelligence agency advises consumers and businesses to keep using the password+2SV combo, but use a [6]password manager so those passwords remain complex and unique to each service.
As Reg readers know, keeping passwords unique means that if - for example - they end up in an infostealer dump, they can't be used to access several accounts. Using 2SV on top of that adds another layer of protection in case a cybercrim successfully gathers the correct username-password pair.
[7]
Jonathon Ellison, director for national resilience at the NCSC, said:
"The headaches that remembering passwords have caused us for decades no longer need to be a part of logging in where users migrate to passkeys – they are a user-friendly alternative that provides stronger overall resilience.
"As we aim to accelerate the UK's cyber defenses at scale, moving to passkeys is something all of us can do to improve the security of everyday digital services and be prepared for modern and future cyber threats."
[8]Hungarian government creds left in the safe hands of 'FrankLampard'
[9]You probably can't trust your password manager if it's compromised
[10]Your AI-generated password isn't random, it just looks that way
[11]One criminal, 50 hacked organizations, and all because MFA wasn't turned on
Passkeys work by creating a cryptographic key pair between a user's device and the protected account. They can't be guessed or phished, are up to eight times faster to use than passwords, and eliminate the fatigue of creating and remembering credentials.
For years, passkeys were widely considered to be the eventual killers of the password. Promoting passkey adoption is another step the NCSC is taking to boost the state of UK security.
[12]
Richard Horne, the agency's CEO, [13]said this week the number of nationally significant cyberattacks hitting Britain is hovering around similar levels as October, when the NCSC said it [14]witnessed four every week .
Factoring in the current state of geopolitics and the ever-sophisticated [15]frontier AI models threatening defenders, Horne urged organizations to prioritize security hygiene as the country enters a period of "tumultuous uncertainty." ®
Get our [16]Tech Resources
[1] https://www.ncsc.gov.uk/blog-post/passkeys-not-perfect-getting-better
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aentxew7XsGDslzBAWMr3wAAAMI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2025/05/04/security_news_in_brief/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aentxew7XsGDslzBAWMr3wAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aentxew7XsGDslzBAWMr3wAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2026/02/16/password_managers/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aentxew7XsGDslzBAWMr3wAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2026/04/11/hungary_government_logins_breach/
[9] https://www.theregister.com/2026/02/16/password_managers/
[10] https://www.theregister.com/2026/02/18/generating_passwords_with_llms/
[11] https://www.theregister.com/2026/01/06/50_global_orgs_hacked/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aentxew7XsGDslzBAWMr3wAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2026/04/21/ncsc_chinas_cyberattacks_uk/
[14] https://www.theregister.com/2025/10/14/ncsc_uk_cyberattack_surge/
[15] https://www.theregister.com/2026/04/12/ai_open_weights_models/
[16] https://whitepapers.theregister.com/
Re: Great!
Clearly you don't understand how passkeys work - go and do some research before shooting your mouth off...
Re: Great!
Well, let's see. The passkey is a complex password stored on my device/in the cloud that a site or program ask for. I unlock my vault with a password/PIN/face/fingerprint and the site/program verifies the device is authorised.
How am I doing so far?
Re: Great!
I understand that passkeys add a strict dependency on a specific device, an Internet connection being available, a specific cloud service being available, or a combination of the three, depending on implementation. Any of these is a point-of-failure, which can and does fail in real life, and whose mode of failure is that you're locked out of the service you want, with no easy workaround.
By comparison, a proper password manager with encrypted local storage and sync across several devices lets you use high entropy passwords that are immune to guessing and bruteforcing, and only locks you out if all of your devices are unusable AND you're offline on top of that.
If I'm wrong, I'd like an explanation or a pointer to where I can get one.
Re: Great!
Why do you need access to a cloud service to use a passkey? I can store passkeys in my browser or 1Password which are stored locally on my machine.
Re: Great!
What happens when your machine decides to curl its toes up?
Re: Great!
I do have a pocket-computer (aka smartphone) but it's not my main phone and I definitely don't have it with me all the time.
Storing them in the browser works only when you are on your computer or when you spend an unhealthy amount of time fiddling with softwares and devices so everything is sync'ed and integrated.
Re: Great!
"I can store passkeys in my browser or 1Password which are stored locally on my machine."
I can store my passwords locally on my machine in Keepass. I can sync to my local NextCloud and from that to my spare machine.
Keepass is encrypted and protected by its own password which is the only one I need to remember.
Re: Great!
There are passkey card options like PIN protected Fido2 cards for 15 quid. 300 passkeys per card. Though you'll want to maintain a backup card or 3 for the important services.
www.token2.com/shop/category/fido2-cards.
We'll see over time, hopefully they are less vulnerable to breakage over a long term than the older TOTP synchronised number generators.
Re: Great!
Most (95%) of my accounts that currently use passwords don't protect anything of any value (sorry, but that does include the el Rego. login.)
Basically like suburban fences - keeps honest people… well, honest. The serious miscreant will easily hop over them.
The inclusion of a device identifier in the passkey generation will be a PITA where the service is accessed from multiple devices (phones, tablets, notebooks and desktops - from experience that can easily add up to well over 6.)
Most banking apps seem to use passkeys already (and 2FA) but with most users having everything on the one phone the security is only as good as the phone's I suspect.
I wouldn't mind using an optional TOTP where I provide the secret (key) - the otpauth:// URI format is accepted (either directly or via QR code) by most OTP clients. Getting the six digit code via SMS seemed just plain daft to me.
Dislike passkeys
Handing your security to someone else and insisting on a cloud connection is not safe or wise, especially as all the big passkey providers are US based. Seems more secure as cert based but really makes it less usable and potentially more exploitable due to a permanent file holding the security information.
Password manager, complex by default unique passwords with MFA MUCH more secure. Using passkeys will eventually seen as a bad decision, much like contracting Palantir or thinking an Oracle implementation will stick to budget.
implementation
There's a lot of benefits to Passkey for sure, and I don't think it needs any cloud connection as such above the site you're trying to authenticate with. The bigger issue is that it needs some sort of management software, and from what I've seen that's now all over the shop, and least supported on PC.
For the average Joe it protects against a lot of problems. But the average Joe also needs a reliable manager to manage them, passkeys fragmented across 3 apps, and only on their mobile.
Companies not listening
It would be great if I could just use my YubiKey to log in to the various web sites and services that I use. It would also be great if I could log in to Windows and RDP sessions at work with a YubiKey.
Is the company I work for planning to use passkeys? Nah, they think Windows Hello is a good idea. FFS.
Do any of the web sites or services that I use support passkeys? Only one of them.
Passkeys are a great idea, but as far as I can see, there's too much "not invented here" and inertia to make them commonplace.
Yeah great.
I have an Android phone, an Apple Tablet, a Windows Laptop and Linux desktop.
So I'd have to try and remember which one is set up with which and then find the correct device for that service.
Or I just use Proton Pass across all devices
Re: Yeah great.
You can have a PassKey a service >1 device though
Implementation lacking
I like passkeys and the idea of them - it's the implementation that leaves a lot to be desired. I can't create a passkey on my Nintendo account, despite it having been supported for about two years now, because they use server-side code to only allow their creation on Android or iOS. I have a modern Yubikey which has had support (and been used) on multiple other websites, but no - the site insists I must use a mobile device, and even blocks the Yubikey on those.
Tying your account logins to another layer of account lock-in to a giant provider/operating system vendor is plain stupidity, so unless sites as a whole get their act together and stop limiting by device, they remain a no for me. And for god's sake, let me add more than one passkey so I can log in from another device without having to sync to a server!
Re: Implementation lacking
Weird I have a Nintendo Account passkey set up on my Windows laptop.
Password + 2FA still works best for me.
Password managers are all very well for people who use one or maybe two devices.
All though I have a primary PC at home and one at work, I use several devices both at home and work where I either cannot use a password manager or have no desire to use one with.
Some of them will also be 'guest' accounts or some generic account that I don't want any personal data stored on.
I know little about how passkeys work as there seems to be no particular standard but I'm guessing it would be a similar situation as I've described?
Other than a physical key, such as a USB key, I don't see how anything can be more secure than 2FA, assuming the user doesn't fall for social engineering attacks etc?
Or maybe I'm just a stubborn old git who needs to get with the times!!!!
stubborn old git who needs to get with the times ?
Bugger that. Just look at "the times." Who in their right mind would possibly "need to get with" these times ? "Get without" makes more sense.
Just wait long enough and familar, saner times will catch up with you.
Great!
So now instead of relying of memory or my trusty paper notepad I have to rely on an internet connected device and the benevolence of the cloud provider.
Of course, now everybody and his dog will INSIST on using a password..., sorry, passkey for everything, even if that's not necessary. And a special app working only on the latest flagship devices.