We removed passwords, now what?

The talk starts from the growth of passkeys, including security keys, platform authenticators and synced passkeys, and the trade-offs of each. Passwordless sign-in creates a problem for account recovery, because the usual fallbacks such as SMS codes, email, one-time passwords and support calls each have weaknesses, and support calls can be abused through social engineering. The speaker presents identity verification as the replacement check and gives examples where it went wrong: a hiring case where the person who started work was not the person who was interviewed, a government verification flow that relied on scripted video reads, and a ride-sharing profile that showed verification passed despite an obvious problem.

The middle of the talk covers the difficulties of identity verification itself. Storing IDs, selfies and videos creates personal data risk, purchased selfies and deepfakes can defeat checks, recorded video can expose a person's surroundings, and face matching that never tested negative cases accepted clearly different faces. A sample recovery flow chains a username, an SMS code, a location check, an ID scan, facial recognition and a manager review. The talk also notes user friction, such as a bank that repeated verification after a phone change.

The closing recommendations are to add identity verification to account recovery, use an established vendor because of legal and regulatory obligations, test negative cases and not only the successful path, and move toward passwordless sign-in where possible. The Q&A covered liveness detection against deepfakes and the trade-off between convenience and security in choosing how passkeys are stored.