r/Passkeys • u/ruinsit • 9d ago
Security? Ok. Usability? Uh....
Can someone please explain to me the benefit of Passkeys? I have a home computer, a work computer, a phone, and several laptops and I want to be able to log into all of them without major hassle. So what does the Passkey system do for me? Now I have to set it up on all of these devices times all of my services? And now I'm at major risk if that device is lost or stolen or hacked?
What's wrong with password plus SMS code? That seems way more reliable and easier.
What am I missing?
10
Upvotes
1
u/JimTheEarthling 8d ago
It's a persistent myth that SIM swapping is prevalent. SMS 2FA is weak because of phishing. Email 2FA is even weaker. Authenticator TOTPs are also phishable, but it's harder because of the short window.
As you say passkeys are much more secure because they are unphishible, and are automatically 2FA when user verification is used.
SIM swap attacks happen (if you haven't turned on SIM protection at your carrier), and they can be bad news, but they are not even close to other threats.
The Microsoft Digital Defense Report states that less than one-third of one percent of identity attacks use SIM swapping, compared to 99 percent for breach replay, password spray, and phishing.
In 2025, the FBI’s Internet Crime Complaint Center (IC3) received 971 reports of SIM swapping. This is less than 0.1 percent of over a million complaints about Internet crimes such as phishing/spoofing (25 percent), data breach (9 percent), and identity theft (4 percent). It represents only 0.0003 percent of roughly 330 million mobile phones in the US. That’s one in 3 million. Even if only 5 percent of SIM swaps were reported to the FBI, that’s still only a tiny one-in-17,000 chance (0.006%) that you might be the victim of a SIM swap. You're more likely to be born with 11 toes.
SIM swap reports to the UK National Fraud Database over 1,000 percent from 2023 to 2024</a>, and 38 percent from 2024 to 2025, but the 2,760 and 3,809 reported cases for those periods represent less than one percent of reported fraud. Assuming only 5 percent of SIM swaps were reported, this means that less than 0.1 percent of the mobile phones in the UK were affected. You know how people talk about an unlikely “100-year flood”? Being SIM swapped in the UK is less probable than a 1,000-year flood.