The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes. Joseph Bonneau and colleagues presented this work at the IEEE Symposium on Security and Privacy in 2012. They compared authentication systems without assuming that security alone determines whether one can replace passwords. Their framework asks what each option gains or sacrifices in usability, deployability and security. The takeaway is that no evaluated option cleanly replaced passwords. Synchronized passkeys plausibly come closer to the desired combination, but whether they replace passwords or relocate trust is disputed, and recovery and fallback still shape an account’s real security.

First, the framework uses a strict idea called dominance. One scheme dominates another only if it matches every scored benefit and improves at least one. Replacement is therefore not just a contest over attack resistance; an alternative must also work for users and be practical for services to deploy. Every evaluated alternative lost to passwords on at least one deployability property, helping explain why security advantages alone did not settle adoption. The authors predicted that password managers would become routine if passwords remained, while warning that managers still submit replayable static credentials and do not eliminate the server-side credential problem.

The comparison asks a different question from simply choosing the strongest login method. It asks which combination of benefits fits a particular deployment and what tradeoff is being accepted. Bonneau and colleagues deliberately refused to assign fixed weights or collapse everything into one score, because each benefit’s value depends on context. The framework is therefore a decision aid, not a universal league table.

The team defined 25 properties spanning usability, deployability and security, with privacy included under security. They applied them to 35 authentication schemes in a semi-structured expert comparison. A coauthor initially scored each scheme, and the others reviewed and refined those judgements. This was a systematic comparison, but not a controlled experiment or production measurement. The scores organize tradeoffs; they do not measure user failure rates, operational costs or risk reduction in live deployments.

In the 2012 comparison of 35 schemes, none dominated passwords. No candidate delivered every usability benefit, and every alternative gave up at least one deployability benefit. Different families had different drawbacks. Hardware, paper and phone-based methods could offer strong security properties. But they required users to carry something, added cost or setup friction, and made recovery or compatibility harder. Federation improved usability and security but concentrated trust. It also created privacy and linkability concerns while remaining exposed to phishing. Biometrics were judged weak for unsupervised web login at the time. A compromised client could replay captured data, while biometric secrets were hard to revoke and recovery remained difficult.

Now consider passkeys. A passkey is a public-key credential built on Web Authentication. Web Authentication binds the credential to the genuine service and does not send that service a shared secret. It also requires user presence or verification. When implemented correctly, the binding resists phishing by an impostor site. A commissioned industry report estimated more than 5 billion active passkeys. Deployment quality nevertheless varies. A separate measurement security-tested 103 services supporting passkeys, and none passed every check.

Two layers of limitation matter. The original comparison relied on expert judgement and omitted or compressed its treatment of active interception and relay attacks. Operational questions around migration, maintenance, recovery and offboarding were also incomplete. Mobile use and business incentives were also omitted or compressed. Modern passkey evidence does not erase those gaps. Vendor implementations differ, and FIDO does not specify every security property of credential synchronization. Password or email recovery can also lower effective assurance. Accessible authentication requires an accessible path through sign-in, multifactor checks and recovery, not only the primary prompt. Deployment brings further obstacles: legacy compatibility and policy can block rollout, while support costs and change management complicate adoption.

For defenders, evaluate the account as a sequence rather than a single login prompt. Start with enrolment and everyday sign-in. Then test use on another device and device loss, including recovery. Finally, examine provider migration, compromise response and offboarding. Check whether an attacker can route around the passkey through a remaining password or phishable one-time code. Test weak email reset separately. Security architects should document the platform account and device controls that now carry trust. They should do the same for the synchronization service and recovery process. This is an operational interpretation of the evidence, not proof that every synchronized-passkey deployment is unsafe. The assurance claim should match every accepted path through the account.

Bonneau and colleagues contributed a framework for making authentication tradeoffs explicit across security, usability and deployment instead of declaring a winner from one property. The original evidence supports a restrained conclusion: no evaluated scheme preserved every password advantage while improving on it. Later evidence makes synchronized passkeys a plausible closer fit, but whether that amounts to replacing passwords or relocating trust is disputed because account control depends on platforms, devices, synchronization and recovery. Identity teams and security architects should compare the full lifecycle and harden fallback. They should not infer that a phishing-resistant primary login makes the whole account phishing resistant when phishable fallback or recovery remains.