Passkeys
Phishing-resistant FIDO credentials: per-site key pairs stored on a device or synced by a platform, unlocked with biometrics or a PIN.
A passkey is a discoverable WebAuthn credential. The authenticator creates a key pair scoped to the relying party ID (the site's domain); the server stores only the public key and verifies a signature over a fresh challenge at login. Synced passkeys are backed up by iCloud Keychain, Google Password Manager or third-party managers; device-bound ones live on a security key.
They resist phishing because the browser only offers a credential for the matching domain, so a lookalike site gets nothing to replay. There is no shared secret on the server to leak, which removes credential stuffing too.
Practical issues: account recovery becomes the weak link, synced passkeys move trust to the platform account, and attestation is usually unavailable for synced credentials. Keep a fallback that is not weaker than what you replaced.
Learn it properly
Also used in
- Identity: authentication, authorisation and tokensSecEng · Foundations of Security EngineeringFree
- Secure design principles that still holdSecEng · Foundations of Security EngineeringFree
- Design an SSO identity providerHLD · Design problems: Access & identityFree
- Design a TOTP verifierLLD · Problems: crypto & protocol componentsFree
- SSO at scale: SAML, OIDC and SCIMSecEng · Identity & Access EngineeringPro
- Zero trust reference architectureSecEng · Advanced: Security Architecture at ScalePro
- Business email compromise investigationsAnalyst · Incident handling & reportingPro
- Writing incident reports for executivesAnalyst · Incident handling & reportingPro