Passkey
A passkey is a WebAuthn public-key credential that replaces a password. Possession of the authenticator plus a user verification step proves identity, with no shared secret transmitted to the server.
Passkeys removed remote phishing as an attack path, which is a genuine change in the threat model, and the 2026 research wave clarified what they did not remove. Every published break started with malware already on the endpoint and attacked the plumbing (event logs, sync key custody, in-session key reuse) rather than the cryptography. The practical rule: synced passkeys for consumers, device-bound hardware authenticators for administrators.
See also: WebAuthn and FIDO2, phishing-resistant MFA, passkey rollout checklist, passkeys had a hard month
Related on Start with Identity
- GlossaryWebAuthn
A W3C standard browser API for public-key authentication. WebAuthn is the protocol used by passkeys and FIDO2 security keys. The relying party server stores the
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- GlossaryFIDO2
FIDO2 is a set of specifications from the FIDO Alliance plus W3C. It combines WebAuthn (the browser API) with CTAP (the client-to-authenticator protocol) to ena
- GlossaryNIST SP 800-63
The US National Institute of Standards and Technology Digital Identity Guidelines. Defines Identity Assurance Levels (IAL), Authenticator Assurance Levels (AAL)
- CVEWindows stores WebAuthn assertions in cleartext event logs
The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black
- GuideIdentity Federation Implementation Guide: Protocols, Trust, and Cross-Domain SSO
A step-by-step guide to implementing identity federation covering SAML, OIDC, and WS-Federation protocols, trust relationship configuration, attribute mapping,