Lessons From a Financial Services Passkey Deployment
summary
Branch Insurance replaces SMS TFA with passkeys using Descope on top of Cognito, keeps Cognito as a cheap fallback, and stages migration in 11 migration waves starting with 100–300 users. Implementation includes Okta SSO for employees, per-developer AWS accounts deployed via YAML/CloudFormation, and an email one-time password fallback. Early adoption sits at ~25% with a goal of 60–70%. Operational pitfalls include OIDC five-minute timeout, incorrectly linked identities, and random Cognito passwords requiring user resets.
AI-written summary · about
chapters (5)
- 0:00Introduction to passkey deployment
- 4:39Migration strategy decisions
- 12:49Scope and V1 features
- 18:51Environment setup and flexibility
- 24:51Lessons learned and results
related talks
30mWhere we’re going… we won’t need passwords
18mShifting Authentication at Scale
31mRolling Out Passwordless
43mPasswordless: a story of risk, protection and excellent UX
40mNOPASSWD: Building a Passwordless Cloud Infrastructure
01h 00mFeatured Keynote
21mEarning Trust in Identity at Scale
50mNOPASSWD: Building a Passwordless Cloud Infrastructure