Relying Party Security
summary
Passkeys replace passwords and relying parties must rework back ends to store multiple device keys per user, check the backup eligible flag and the backuped indicator before removing old recovery methods, and verify the user verification bit in each assertion because it’s optional. Discoverable credentials improve UX; Apple supports AirDrop sharing so passkeys can be copied and re-shared. No multi-device passkey currently provides primary attestation and there are effectively no DPK attestations in the wild, so treat unknown registrations as multi-device.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:46What are passkeys
- 3:53Passkeys vs passwords
- 6:20User verification options
- 11:00Backup and sync considerations
- 15:42Passkey sharing risks
- 18:14Device fingerprinting limits
- 21:48Implementation challenges
- 23:10Q&A
related talks
30mAuthentication for humans, why passkeys finally make sense.
25mDo Passkeys Solve the Account Recovery Problem?
52mPasskeys: The Good, the Bad and the Ugly
29mWhat the Authn? Passkeys Offer a Fresh Take to Authentication Dilemmas
22mPasskeys deployment at scale - our journey and best practices
22mGuarding the Gate: Strategies for High Security with Passkeys
56mPasskeys 101: Technical Principles of FIDO
26mPasskeys: A Breakthrough Step for Workforce Authentication on Shared Computers