Everything you never knew you wanted to know about Passkeys

The talk opens with the long-running problem of passwords, which are reused, phished, and exposed in breach collections, and presents passkeys as a replacement. A passkey is a machine-generated public and private key pair. The private half stays with the user and is never shared, while the relying party stores only the public half and verifies a signed challenge. Nothing reusable is kept on the server for attackers to take.

The middle section separates the open standard from vendor implementations such as those from Apple and Google, and explains synced passkeys that move through cloud keychains or password managers versus device-bound credentials. It walks through the WebAuthn and CTAP2 exchange, showing how the requesting origin is bound into each signed response, which is why a proxied login page gets nothing useful. Hybrid transport, which uses a QR code and Bluetooth to register a key on a nearby device, is demonstrated live.

The closing part looks at deployment. Support is now broad across major operating systems and browsers, but uneven in some native apps. The speaker stresses planning for recovery and help desk workflows, knowing the user base, and offering alternatives such as hardware keys for users who cannot use phones. Hardware security keys and passkeys are presented as largely the same kind of authenticator.