4 MIN READ
Most passkey deployments look great in the demo. The user enrols the passkey, signs in with the fingerprint, forgets the password ever existed. Then the phone falls in a hotel pool at 2 AM, and the user needs to approve a wire transfer that closes in 30 minutes. That is the moment the deployment is actually tested. The recovery option the user has at 2 AM is the one the security org should have built before the user signed up. Most security orgs have not built it.
Worth being clear about the trade off. Every passkey recovery option trades one risk for another. The hardware key trades convenience for portability risk. The printed recovery code trades usability for screenshot leakage. The help desk override trades self service for social engineering risk. The cloud sync trades lock in for vendor dependency. The right mix depends on the user population, the threat model, and the support cost the team can actually absorb. The wrong mix gets picked in a 30 minute product meeting without anyone who has been paged at 3 AM in the room.
What the user carries
The hardware key sits as the highest security option, and the option with the highest user friction. YubiKey 5, Titan Key, Feitian K9, the USB or NFC token the user keeps on the keyring, with a second one stored in a safe as the backup. Lose the key at the airport and the user is locked out for the 24 to 48 hours it takes to ship a replacement, which is also the 24 to 48 hours the user does not have.
The printed recovery code, by contrast, ships as the option most products default to, and the option most users mishandle. A 24 character string the user is told to print and store somewhere safe, the string the user screenshots to the desktop because the desktop is where screenshots go, the screenshot the infostealer exfiltrates from the compromised laptop.
Single use recovery codes follow the same shape with a different failure mode. Ten codes the user prints and never looks at, until the codes are needed and the codes are in a drawer in a different city.
What the help desk can do
The override serves as the safety net, and the safety net has its own attack surface. Identity verification through the security questions (mother maiden name, last four of the social, the high school mascot) sits as the option attackers have been quietly researching on social media since 2015. The questions are not security. They amount to a usability prompt the attacker already knows the answer to.
Video verification, where the support team asks the user to show a government ID on a video call, runs as the more secure option and the option that takes 25 minutes per case. That is also why it quietly falls off the queue at scale.
The trusted contact, a friend or family member the user designated at enrolment who can vouch for the user, stands as the option attackers go after first, because the trusted contact is the lowest friction path to a yes.
What the cloud can do
Cloud recovery serves as the option the demo leans on, and the option that fails in the moments the demo never tested. iCloud Keychain and Google Password Manager sync the passkey across the user devices, and the sync breaks when the user switches platforms, when the Apple ID gets locked, or when the Google account gets caught in the same credential stuffing campaign as every other Google account.
Cross device recovery uses Bluetooth proximity to a second enrolled device, and the proximity check fails in hotels, on planes, and in the moments the user has only one device because the other one is dead.
Federation through Okta, Entra ID, or Google Workspace amounts to the option most enterprise deployments default to, and the option that depends on the user having access to the federation account, which the user has when the user has it and the user does not have when the user does not. Microsoft and Okta both ship federation as the default, and that default is the one support quietly overrides most often.
The bottom line
The deployment survives the first month by picking the recovery options with the failure mode the user can actually live with, funding the help desk to run the override, and testing the cloud recovery path with the same rigour the security org tests the enrolment. Pick the option that works at 2 AM in a hotel room, or stop calling it a deployment.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
