Corbado Blog

you could also take at look at what we're building at Corbado (passkey-first authentication): https://www.corbado.com

If your a developer, you would probably want to minimize setup time with sth like https://corbado.com

Not an endorsement (haven't read it fully!) but this article goes into some of the difficulties with implementation: https://www.corbado.com/blog/passkey-implementation-pitfalls-misconcep… The #1 issue as far as I'm aware is that there's no good story around portability. It sounds like using Passkey equals vendor lock-in right now. Idk how representative this is, but there's been some criticism recently, and the response from some of the people behind passkeys implementation seem mostly dismissive of the criticism. I base this opinion after watching this 'debunking' video on the criticism of passkeys by some key players: https://www.linkedin.com/events/debunkingmisconceptionsaboutpas7200360… I was kind of surprised they sort of looked down on the people with concerns. I didn't really have a strong opinion about Passkeys, before watching this. But after watching, I got the impression they people behind Passkeys are probably smart as hell but perhaps not the best stewards of developing open standards and advocates for the general public.

I'm pretty sure Safari supports it since iOS 18! See for example https://www.corbado.com/blog/ios-18-passkeys-automatic-passkey-upgrade… and https://www.corbado.com/blog/passkeys-prf-webauthn.

Yes, its called "hybrid transport", and its a flow where a laptop presents a QR code to a mobile phone, who then sets up a BLE connection for one time use of the passkey. https://www.corbado.com/blog/webauthn-passkey-qr-code (Not sure how the "cloud assisted" part of caBLE works)

This is covered by the cross-platform scenario. It's not super elegant, although I'd say it's easier than typing 100+ random characters (and also trusting that the locked down device doesn't have any key logging?). Lots of providers have their own FAQ, but here's one: https://www.corbado.com/passkeys/faq#:~:text=Passkeys%20have%20cross%2…

Third-party passkey providers got added with iOS 17. https://www.corbado.com/blog/apple-passkeys-integration

Could you switch to just using passkeys instead of Google, Apple, or Facebook federated identity? This eliminates the risk of storing passwords, and also doesn't create a dependency on one of the companies mentioned. You'll still need to store username, email, or both, depending on your use case. You can also create a code path that will transition accounts from federated identity to self hosted with passkeys as well. https://passkeys.dev/docs/tools-libraries/libraries/ https://passkeys.directory/ https://www.corbado.com/blog/user-transition-passkeys-expert-strategie…

There are some parts of this that are correct and other parts that are incorrect: >1. The idea was to provide a phishing resistant authentication method for enterprise users (companies loose quite a lot of money to phishing). This is incorrect. The idea was to provide a phishing resistant primary factor that could compete with the usability of passwords to the point that consumers would actually want to adopt it. >2. Majority of industry players shared the vision of a credential which is available across the platforms and browsers This is correct/accurate. > 3. The vision for collaboration never materialized so everyone went their own way to implement it. Examples would be google rolling out browser (Chrome) managed authentication which led to this situation where even on the same machine you have to remember which browser you used to create the Passkey credential. IIRC at least Chrome's default on Apple platforms is to save to the Passwords app by default. There are then multiple fallback options in the case that the user isn't using the default credential provider -- ultimately falling back all the way to cross-device passkey sign-in (the QR-code initiated sign in) or Security Key. The security engineering behind the QR-code cross-device sign-in stuff is interesting: https://www.corbado.com/blog/webauthn-passkey-qr-code#4-passkeys-qr-co… That said, I strongly agree that fragmentation of where passkeys get saved is super confusing and I wish there: (a) was…

PassKeys are definitely the future, they aren't just device-specific, they can be synced also. https://www.corbado.com/blog/nist-passkeys talks about this, though I'll admit I haven't read anything on the subject yet. But I can say that most implementations of PassKeys seem to cloud sync, including 1Password, Apple, Google, Edge, etc. I should also add that PassKeys that are tied to devices are like FIDO2 security keys, you should be able to add more than one to your account so that you can login with a backup if your primary FIDO2 token is unavailable. Likewise, SSO should ideally be implemented such that you can link more than one social network - and a standard email address or backup method - in addition to the primary method you might use to login with. It has always bugged me that Auth0 makes it much harder than it should be to link multiple methods of login to an account, by default.