Passkey
A passwordless authentication standard promoted by the FIDO Alliance, based on public-key cryptography. It replaces traditional passwords with biometric verification or device PIN codes, fundamentally eliminating phishing attacks and credential-leak risks.
Core Facts
Passkey is based on the W3C WebAuthn standard and the FIDO Alliance's FIDO2 specification, with asymmetric key encryption at its core, where the private key is securely stored on the device and never leaves it.
Hardware security keys (such as YubiKey) implement the FIDO2/PIV protocol to ensure that private keys never leave the hardware device.
Timeline (last 90 days)
An article titled "Passkeys are a trap. Do not use them" received 243 upvotes and more than 130 comments on Hacker News.
The FIDO Alliance has in recent years been promoting cross-platform Passkey import and export standards.
If a device is lost and Passkeys have not been properly synced or backed up, users may face the risk of permanently losing access to their accounts.
When Passkeys are bound to a particular vendor ecosystem, cross-platform migration is often extremely difficult, reinforcing vendor lock-in.
The article's criticisms of Passkeys focus primarily on three aspects: portability, vendor lock-in, and user control.
Major players including Apple, Google, and Microsoft are all pushing the Passkey solution to replace passwords.
Hardware-key-based (FIDO2/Passkey) authentication methods bind verification to a specific device and origin domain, and are currently the most effective form of MFA against session hijacking.
Data in the system Keychain is encrypted at rest at the system level and can only be read by authorized processes of the current user, making the use of Keychain an industry-recommended security practice.
Passkeys are strongly bound to a domain name, providing inherent protection against phishing attacks.
In Passkeys, the private key is stored on the user's device or in a password manager, the public key is handed to the service provider, and the private key itself never leaves the device.
15 more timeline events
All Facts (20)
Passkey is based on the W3C WebAuthn standard and the FIDO Alliance's FIDO2 specification, with asymmetric key encryption at its core, where the private key is securely stored on the device and never leaves it.
70%VerifiedHardware security keys (such as YubiKey) implement the FIDO2/PIV protocol to ensure that private keys never leave the hardware device.
65%UnverifiedPasskey, as a consumer-level evolution of FIDO2, is jointly promoted by Apple, Google, and Microsoft and supports cross-device synchronization.
60%UnverifiedThe FIDO Alliance has in recent years been promoting cross-platform Passkey import and export standards.
50%UnverifiedMajor players including Apple, Google, and Microsoft are all pushing the Passkey solution to replace passwords.
50%UnverifiedThe article's criticisms of Passkeys focus primarily on three aspects: portability, vendor lock-in, and user control.
50%UnverifiedWhen Passkeys are bound to a particular vendor ecosystem, cross-platform migration is often extremely difficult, reinforcing vendor lock-in.
50%UnverifiedIf a device is lost and Passkeys have not been properly synced or backed up, users may face the risk of permanently losing access to their accounts.
50%UnverifiedHardware-key-based (FIDO2/Passkey) authentication methods bind verification to a specific device and origin domain, and are currently the most effective form of MFA against session hijacking.
50%UnverifiedData in the system Keychain is encrypted at rest at the system level and can only be read by authorized processes of the current user, making the use of Keychain an industry-recommended security practice.
50%UnverifiedPasskeys carry a lock-in risk: when bound to a specific ecosystem, users may encounter obstacles when switching platforms or devices, and the recovery process is often not smooth enough.
50%UnverifiedBefore integrating Passkeys, recovery flows, cross-platform solutions, and user guidance should be carefully designed.
50%UnverifiedPasskeys are strongly bound to a domain name, providing inherent protection against phishing attacks.
50%UnverifiedUnlike TOTP-based two-factor authentication, Passkeys use a challenge-response mechanism in which the service provider sends a random challenge value at each login, which the device signs with the private key and returns, eliminating the one-time password that could be intercepted and replayed by a man-in-the-middle.
50%UnverifiedStoring Passkeys in a password manager shifts the security dependency from the device's local hardware to the security strength of the password manager account, as the two have different threat models.
50%UnverifiedIn Passkeys, the private key is stored on the user's device or in a password manager, the public key is handed to the service provider, and the private key itself never leaves the device.
50%UnverifiedBitwarden supports storing and using Passkeys.
50%UnverifiedPasskeys are not always exportable by design, and some passkeys may need to be re-registered in new tools during migration.
50%UnverifiedOpen-source maintainers should enforce two-factor authentication (2FA), prioritizing hardware keys or Passkeys over SMS verification.
50%UnverifiedPasskey is a login method promoted by the FIDO Alliance and jointly supported by tech giants including Google, Apple, and Microsoft.
50%