Implementing passkeys has increased the complexity of login flows.

Are the benefits worth it?

Background

  • FIDO2: The umbrella, from FIDO Alliance. Successor to U2F.
    • WebAuthn:
      • W3C standard. JS API.
    • CTAP: The other half - “client to authenticator protocol”.
      • USB / NFC / Bluetooth. How the browser talks to hardware keys.
    • Passkey: marketing term for a “discoverable credential”.
      • They can be device-bound or synced passkeys. Most ecosystems do synced.

Benefits

  • Websites can now know that a subsequent request is coming from the same private key as a previous login, and sometimes that the private key is in a secure element. This holds for TPM-backed Windows Hello, but mostly not for synced keys.
  • They are public/private key auth. Servers only store the pubkey, so you dodge the risks of storing passwords.
    • Leaked password hashes are a non-issue.
    • Credential stuffing is eliminated (they are per-site).
  • They are phishing-resistant (WebAuthn checks the “RP ID” domain/subdomain).
  • They can allow users to login without typing a username.

Drawbacks

  • They are sometimes bound to ecosystems (Apple, Google, Microsoft), which puts more power in the hands of the tech giants rather than users.
    • e.g. Google account suspension would lock you out of all your passkey credentials.
  • They make login flows more complicated. Every site rolls their own UI/UX.
  • Fallback password login undoes phishing resistance.
  • Stolen synced passkeys count as a 2FA credential, where a rolling TOTP code would not.

In short, they are keypair credentials that replace passwords, synced using your Google/Apple/1Password login.