Passkeys and FIDO, by ear
14 episodes, in order, 5 checked against the publisher's transcript. Phishing-resistant sign-in: how passkeys work, how teams roll them out, and where the standard is heading. Start at the top if the topic is new to you, or jump to the stage that matches where you are.
Start here: the basics
- 1#56 - What is FIDO with Andrew ShikiarIdentity at the Center · 2020-08-10 · 47 min · Learner
What the FIDO Alliance is and which authentication problems its standards are meant to solve, explained by the Alliance's executive director.
- 2Passkeys vs. 2FASecurity Now · 2024-03-12 · Learner
Why a passkey used on its own gives stronger protection than a strong password combined with a second factor, answering a listener's common worry about losing MFA.
Checked against the publisher's transcript - 3#141 - 2022: Year of the MFA BypassIdentity at the Center · 2022-04-11 · 55 min · Learner
Why attackers increasingly bypass traditional MFA and how FIDO possession-based authentication gives IAM practitioners a phishing-resistant alternative.
- 4Root Causes 407: Whatever Happened to Passkeys?Root Causes: A PKI and Security Podcast · 2024-07-26 · Learner
Reasons passkeys and WebAuthn saw slower real-world use in 2024 than their launch publicity suggested.
- 5Biometric Update Podcast Ep. 22: Passkeys ascendant with FIDO's Andrew ShikiarThe Biometric Update Podcast · 2025-11-07 · 27 min · Learner
Where passkey adoption stands, what the FIDO Passkey Index shows about sign-in success and speed, and why making passwords the exception rather than the default counts as progress.
In practice: rollouts and operations
- 6WebAuthn and FIDO2 with John BradleyIdentity, Unlocked · 2020-11-09 · 26 min · Practitioner
How WebAuthn and FIDO2 work, from one of the authors of the FIDO2 specifications.
- 7FIDO Multi Device Credentials with Andrew Shikiar and Tim CappalliIdentity, Unlocked · 2022-06-14 · 41 min · Practitioner
What FIDO multi-device credentials, now called passkeys, are and why they were introduced as a password alternative for consumer applications.
- 8#242 - Authenticate 2023: Passkeys with Pedro Martinez of Thales GroupIdentity at the Center · 2023-10-30 · 42 min · Practitioner
Security and user experience trade-offs of passkeys in financial services, including how platform vendors control passkey synchronization.
- 9#260 - Passkeys with Daniel Grube of TikTokIdentity at the Center · 2024-02-19 · 49 min · Practitioner
How TikTok rolled out passkeys for its users, including offering them at sign-up and the adoption and user messaging challenges, from its product manager.
Daniel Grube (TikTok)passkey - 10How General Motors Moved 200,000 People to PasskeysEntra.Chat · 2026-08-31 · 44 min · Practitioner
How a large enterprise moved a mixed workforce of office, factory, call center and guest users to passkeys without locking people out.
Checked against the publisher's transcriptAndrew Cameron (General Motors)passkey - 11Random but Memorable 15.7: The state of passkeys in 2025 with Nick SteeleRandom but Memorable · 2025-10-14 · Practitioner
Current passkey adoption levels and how the FIDO Credential Exchange Format and Protocol let users move passkeys securely between providers.
Checked against the publisher's transcriptNick Steele (1Password)passkey - 12#373 - Going Passkey Phishing with Nishant KaushikIdentity at the Center · 2025-09-15 · 58 min · Practitioner
Common concerns about passkey security and adoption, discussed with the FIDO Alliance CTO, plus an overview of the Alliance's ongoing work.
Going deeper: standards, architecture, and attacks
- 13Understanding the FIDO Alliance's Standards and Working GroupsA Digital Identity Digest · 2026-02-17 · 12 min · Architect
How the FIDO Alliance develops standards through member-driven working groups and why that process looks different from more open standards bodies.
Checked against the publisher's transcript - 14Pass-the-Passkey: What Michael Grafnetter's Black Hat Research Means for Entra AdminsEntra.Chat · 2026-08-17 · 36 min · Architect
Why passkey phishing resistance relies on the browser, and how local malware bypassed it via event log signature replay, native Windows APIs, browser hooking, and exported synced passkeys.
Checked against the publisher's transcript
How this list was built
Episodes are chosen for what they teach, not for who published them, and ordered so each one builds on the last. Each note is checked against the transcript the show publishes on its own site where one exists (marked and linked under the episode), and against the show notes otherwise. We link to episodes; we do not copy, host, or transcribe them. Vendor-produced shows are labelled on their directory profiles. Know a better episode for a step on this path? Email community@startwithidentity.com.