The floor is the passkey security you already trust. Everything above it is upside.
Passkeys are not the problem
A passkey removed the shared secret from authentication. That closed whole classes of attack at once: there is no credential database worth exfiltrating, and the signature is bound to the origin that asked for it. Against credential stuffing and bulk phishing it is a genuine structural fix. Any vendor who opens by telling you passkeys are broken is selling you something.
This paper takes the opposite position. Passkeys are complete for the question they answer, and the useful conversation is about what that question actually is.
What the paper establishes
Strip the ceremony away and a passkey assertion attests to one fact: a device holding this private key produced a signature, and the device was unlocked when it did. Who was holding it is inference. The inference is usually right, which is exactly why so few threat models ever write it down.
This paper writes it down. It treats possession and personhood as two separate claims, and it judges every design, ours included, by whether the second claim can be proved without weakening the first.
- The three recurring ways possession stops implying the person, each with the attack pattern that exploits it
- How the SenseCrypt ceremony verifies a live person without the platform ever holding a face image or template
- Why the two factors fail independently, and the test that collapses most multi-factor claims
- The hybrid argument, borrowed from how TLS handled post-quantum key exchange
- A factor-by-factor table of what each proves and what exposure remains
- How an existing passkey estate keeps working during adoption, and when it can be retired
Who it is for
Identity architects who have already deployed passkeys, or are about to, and now want a precise account of what is still being assumed. It is the flagship paper of the series and the one to start with if you read only one.
It is not a migration guide. The paper makes the security argument and shows how an existing passkey estate keeps working beside SenseCrypt, but the rollout mechanics live in Biometrics on day one.
Frequently asked questions
Does SenseCrypt replace our passkeys?
It does not require you to. SenseCrypt fronts the same applications over OpenID Connect and SAML 2.0, so moving an application is a routing decision and an existing passkey estate keeps working alongside it. The paper covers when a parallel passkey path stops adding anything.
What does a user need to install?
The companion app on their own phone, which is the trust anchor: hardware-backed keys and app attestation on every call. The target device, whether a browser, a kiosk, or a desktop, needs no enrollment then or ever.
How long is it?
Seven pages, with two diagrams and a factor comparison table.
Related reading
