FIDO2 and passkeys

What are passkeys?

A passkey is a key pair for sign-in. The device creates the pair at registration. It keeps the private key safe. It sends the public key to the site.

FIDO2 is the open standard for this method. Two parts make up FIDO2: WebAuthn and CTAP. Together they let a browser and a device use a passkey.

How do FIDO2 and passkeys work?

The site sends a challenge at sign-in. The device signs the challenge with the private key. The site checks the signature with the public key. A match proves the user holds the device.

The private key never leaves the device. A user unlocks the key with a local check. This check can be a PIN, a fingerprint, or a face.

• —Registration: the device creates a key pair for one site.
• —Sign-in: the device signs a challenge from that site.
• —Sync: some passkeys sync across the user devices.

Why are passkeys phishing-resistant?

A passkey binds to one site domain. The browser checks the domain before it signs. A fake site has the wrong domain, so the passkey does not respond.

There is no shared secret to steal. So a phishing attack cannot capture and replay a passkey.

What does a passkey prove, and what are its limits?

A passkey proves possession of a device. It shows that a user holds the registered device. A local unlock can add a second factor.

A passkey does not prove who holds the device by itself. A shared PIN or a device unlock can pass to another person. Some teams add an inherence factor for a stronger check. An inherence factor is a biometric trait, such as a face.

How does SenseCrypt compare with passkeys?

SenseCrypt is a passwordless identity provider (IdP). A user enrolls from a photo on file. The user then signs in by face. Face matching runs on-device. SenseCrypt stores no biometric data on the server.

A passkey proves that a user holds a device. SenseCrypt proves the enrolled person by face. Both methods remove the password. Both methods resist phishing.