Passkeys

Passkeys appeared as a way to avoid common auth issues:

• Weak passwords

• Phishing

• Password/cookie theft

• Lack of a second factor

• MITM or Leak

• Cost with 2nd factor

They promote better usability, and no need to generate/memorize/manage hundreds of passwords.

How

Using auth material from the user directly in the device, will never be exposed to others.

• Face, Fingerprint, PIN code (PIN can be alphanumeric)

• Auth material enables the process but it is not sent.

Generating a keypair, whose public key is stored at the service. Compromise of the service will only allow access to the public key.

Authentication considers the service, device, keys and user, implicit use of 2FA and external HSM may be used.

Why: No secret is exposed to third parties, and the browser matches the domain, blocking phishing and typos.

Functionality

Device Bound Passkeys: device-specific keys that may never leave it, such as typical FIDO2 keys.

Attestation: capability to ensure the provenance of the authenticator. Ensures that the authenticator is providing the auth data.

• The public key is packed into an attestation object, signed by a private key.

• Very flexible, as long as the relying party can verify the attestation.

Synced Passkeys: the capability to keep passkeys available. Passkeys are backed up and used when required.

Limitations

Device support: It’s still a new technology.

Device dependency: Passkeys are rapidly device-specific. Cross Device Authentication allows linking devices but authenticators must support it. Different ecosystems may still not be fully interoperable.

Biometrics are not that safe against local attacks, but most attacks are not local, at it’s better than only passwords.