vdelitz

We analyzed passkey adoption across readiness, creation and usage in prod deployments. Some interesting KPIs and data are in there.

What do you think about adoption data?

Have to disagree with the author's opinion. I think he compares passkeys only to passwords (single factor) and assume people always use autofill.

But you should compare the passkey UX to conventional MFA UX. I think there it's obvious that passkeys are superior (+ the phishing resistance on top. Even if non-tech-savvy users would like to disclose their credentials on a fraud website, they couldn't).

What do you think?

Thanks!

Did you work with webauthn in consumer or workforce auth context?

you can use a password manager to store your private-passkeys, so as long as you have access to it, you don't need to worry about lost devices

how do you want to detect if the user has a password manager? Checking if the DOM is changed by the password manager's autofill?

clearly biased: https://corbado.com

Great step into full cross-platform passkey sync capability - now only iOS of the major operating systems is left. This will be only a matter of time IMO.

Hey,

I am Vincent from Corbado. We’are building a dev tool that lets you easily integrate passkey auth into your applications. Since secure & user-friendly authentication is very important to us, we have had hundreds of talks with devs and PMs on how we can help them integrate passkeys and thus make the Internet a safer place by sharing our passkey learnings. Many said they are not sure if their users’ devices are passkey-ready.

Therefore, we built State of Passkeys, a free tool, where we provide passkey-readiness data that we collected over the past years to help other developers and product managers roll out passkeys with confidence.

To determine the passkey-readiness of their users’ devices, State of Passkeys serves the largest existing, publicly available data collection on passkey-readiness. You can get analytics on passkey-readiness depending on operating system, device, browser and passkey-readiness features (WebAuthn, platform auth, Conditional UI, passkey sync).

The data is collected (anonymously and GDPR-compliant) via an analytics script by using the browser Web Authentication API.

We're really happy we get to show this to you all, thank you for reading about it! Please let us know your thoughts and questions in the comments.

Check it out here: https://state-of-passkeys.io

There's a new trend coming up of "Smart Wallets" which make use of synced passkeys for authentication.

I can share a blog post about this topic that I recently wrote if you're interested in some details (e.g. Coinbase did it this way).

1) They link the public key to your user account in their database.

2) Passkeys are 2FA by default. Someone needs to steal your phone where the private key is stored (first factor) and they would need your Face ID / Touch ID / PIN Code (second factor). Just loosing your phone doesn't give someone else the chance to use your passkey for authentication.

Yes, that might be a strategic thinking of big tech. Still you can use third-party password managers like Bitwarden, KeePassXC or 1Password to take care of your passkeys. I think, for most non-technical users, they will go for the Apple/Google/Microsoft credential manager option but if you're more tech-savyy, there are ways to stay independent of big tech.

Agree. If I show my parents or great-parents TOTP, they're usually lost and hate it. Recently, I've seen a study that anyway +90% of users choose SMS OTP over TOTP.

Why would it be bizarre to have passkeys?

It still requires you to install the 1Password app or browser extension manually on all devices. Google leverages Chrome & Google Password Manager that most non-technical users have installed / enabled by default.

While I agree that 1Password has the cross-platform sync feature for some time, I think it's different magnitude now that Google offers it (via GPM), as GPM works as the default password manager for many, many non-technical users.

I think that's quite an interesting strategic move which could have tremendous impact on the whole passkeys provider / password manager ecosystem.

What do you think will be Apple's next move?

do you think they will now also employ passkeys as a form of digital tokens or do you think that they will rather use other methods?

Disclosure: I'm the author of the first blog post.

I think my personal biggest learning when developing passkey-based authentication is that there's a bunch of useful WebAuthn libraries for every major language / framework. However, these libraries only cover very basic uses cases to login and create a passkey. In real-life applications though there are so many scenarios (users deleting the private key of a passkey, users using non-passkey-ready devices, etc.) that require substantial work on your own and it's not really obvious when you start developing a passkey-based auth solution. It's something that most devs discover on the journey.

Do you still think it's easier to type in a 6 digit code that is on your mobile while you're browsing with your desktop (compared to Touch ID / Face ID with passkeys)?

at most relying parties you can create multiple passkeys, so this is IMO a good solution until portability might be better

I'd be really interested in your implementation. Can you share a link or some code?

From UX and security perspective (especially for non-technical users), passkeys will be the default login method in the near future.

Recently, there have been some more strategic discussions (e.g. [1] or [2]) about the motives of Google and Apple and their passkeys push (if this is a good or bad thing).

The reality is: passkeys cannot be stopped.

They are much simpler and more convenient for consumers (and more secure!). However, there are still many factors to consider and I fully understand that there are many misconceptions, pitfalls, and unknown unknowns, especially for developers. A lot of these stem from the complexity that becomes apparent when one looks behind the surface and tries to really implement psskeys.

I want to share some learnings from the past two years of working on passkey implementations, so that other developers can better anticipate common fallacies, save time, and more easily implement passkeys.

What are your experiences when implementing passkeys?

[1] https://news.ycombinator.com/item?id=40165998 [2] https://proton.me/blog/big-tech-passkey

We launched Corbado on Product Hunt and reached #1 Developer Tool of the Week. Read about our learnings and tips on how to successfully launch Developer Tools on Product Hunt.

great article!

Explore drawbacks of CAPTCHAs for users and businesses, discover alternatives like Turnstile, Arkose and hCAPTCHA and learn how passkeys could replace CAPTCHAs in this blog article

you could also take at look at what we're building at Corbado (passkey-first authentication): https://www.corbado.com

You could check out what we're building at https://www.corbado.com. It's passkey-first / passwordless authentication solution. Technically, it's based on HTML5 web components which are framework-agnostic and work perfectly with vanilla JS.

Maybe it's useful in your case.

When working on a WebAuthn / passkey implementation and also testing with real-life users, I encountered many issues (technically and also from the user understand) when it comes to how passkey cross-platform authentication works with QR codes and Bluetooth.

In my opinion, I think this is a huge change for many non-technical users and as a website / app implementing passkeys, I would avoid the QR code to be displayed (even if it's technically not 100% possible). What's your experience with it?

Enterprises have more requirements for passkeys than consumers do. Let's have a look how well (or bad) the three tech giants implement them!

I think the main reason for that is that you can then offer different authentication methods depending on what works for you and what kind you prefer. If the provider only offers passwords, than this is neglectable. But if you also use SSO, social logins, magic links or passkeys, then it makes sense to tailor the UX to your account.