All Things FIDO (Panel + Q&A)

The panel, held at PasswordsCon during BSides Las Vegas 2022, brought together representatives from the FIDO Alliance and major platform vendors to discuss FIDO standards and the move toward passkeys. The moderator opened by contrasting the early YubiKey pitch from over a decade ago with where the ecosystem stands now, and the panelists agreed that usability has become the main focus when it comes to reducing reliance on passwords.

Panelists described how passkeys are presented to users as a screen-lock sign-in that syncs across devices through platform providers, and how user research with an outside UX firm shaped terminology and onboarding flows. Much of the discussion covered the security trade-offs of syncing credentials through vendors rather than keeping them on a single hardware token. Account recovery after device loss, shared devices, vendor lock-in and privacy concerns around consumer federated sign-in also came up, with the speakers acknowledging that several of these problems remain open.

For developers, the speakers said platform APIs and open-source libraries reduce the implementation work, and pointed to developer resources and a community group being built out. Audience questions pressed on phishing resistance, credential cloning and revocation. The practical takeaway was that passkeys are meant to become the default for most consumers, while hardware security keys remain the recommended choice for high-assurance use cases.