Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.
But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.
I broke down how passkeys work, their strengths, and what’s still missing
And there is the problem I have with passkeys. With a password it is me authenticating to the service I’m using. Pretty straight forward (if you ignore the operating system, web browser, network protocols, etc., but that’s part of using the tech).
With passkeys you’ve got this third party storing your keys that increases your attack surface. It could be your web browser, your OS, or some cloud provider that you’re now relying on to keep your data safe. I get that for people whose password is “password123” or who aren’t savvy enough to avoid phishing maybe this helps. But with decent opsec this overly complicates authentication, IMO.
To my point, later in the article:
What’s that now? The weak point is the user’s ability to implement MFA and biometrics? The same users who couldn’t be bothered to create different passwords for different sites? You see how we’ve just inserted another layer into the authentication process without solving for the major weakness?
With my tinfoil hat on I suspect this push toward passkeys is just another corporate data and/or money grab – snake oil for companies to get their tentacles tighter around your digital existence.
Happy to be proven wrong.
Today we use lots of accounts with unique passwords. Obviously these passwords have to be stored somewhere. So I disagree with you when you say it’s a unique passkey thing.
Passkey has an advantage when it comes to phishing because it doesn’t totally rely on human intelligence or state of mind.
From a personal experience my data was leaked online, not because of phishing or I was careless. but it was leaked from a well known third party site which I used. They were affected by a very serious breach. Many unlike me use the same passwords for their emails and stuffs. But in case of passkeys there isn’t a shared secret. A breach will be useless.
I think you’re making my point. First, you’re right that passkeys can’t be phished. But access to the passkey manager can be. And now you’ve doubled your exposure to leaky third parties, once with the service you’re accessing and another with the passkey manager.
Passkeys can’t be phished.
That’s the main point.
Phishing is a reeeeal pain. And something that needs to be solved. Not through training but with technology.