Passkeys: Where we started and where we're going

The talk opens with a 2009 phishing breach at Google, which the speaker gives as the reason the company committed to keeping credential phishing away from its staff. It then follows the FIDO work that came after: the U2F protocol built around removable USB security keys, the move to built-in platform authenticators such as fingerprint and face unlock, and the WebAuthn specification that lets websites use them. The speaker argues these steps improved security, but passwords stayed in place as a fallback and adoption stayed low because users had to buy and carry hardware.

Passkeys are presented as the next step. They reuse the same FIDO cryptography, but their private keys can sync between devices within one vendor's ecosystem, and they can be used across ecosystems through a proximity flow that scans a QR code and connects over Bluetooth. The speaker ran a live Android demo in which a user created a passkey during a bank login, was offered it through autofill, reused it in the bank's app, and then signed into a laptop with the phone nearby. Discoverable credentials remove the need to type usernames, and keys remain bound to the hardware.

For practitioners, the takeaways are that a passkey combines possession and user verification in a single step, that sync scope follows platform ecosystems rather than browser profiles, and that sites should plan for autofill-driven sign-in instead of relying on dedicated buttons. The session closed with an open question about how a platform should verify that a new device belongs to the same user.