Peeling Back the Passkeys Onion
summary
Explains how passkeys actually work across four players — relying party, browser, OS and authenticator — and which signals change UX: allowCredentials lists (jump straight to biometric or USB flows), authenticator attachment (platform vs cross‑platform), transport flags (USB vs internal) and new hints (order preferences rolling out). Shows concrete behavior in Chrome/iCloud/Windows Hello: last‑used provider surfaces, browser aggregates local providers, extensions complicate flow, and allow lists reduce prompts and directly trigger the correct prompt.
AI-written summary · about
chapters (11)
- 0:00Introduction by Matt Miller
- 0:57Speaker introduction and Passkeys overview
- 2:23Terminology refresher
- 4:29Passkeys registration and authentication flows
- 6:14Complexity of Passkeys ecosystem
- 8:40Registration experience touchpoints
- 12:33Authentication experience touchpoints
- 17:04Local Passkeys and external authenticators
- 19:51Browser extensions in Passkeys
- 20:36Key takeaways and ecosystem challenges
- 22:04Q&A session
related talks
52mPasskeys: The Good, the Bad and the Ugly
45mPasswords Are So 1990
45mPast Time for Passkeys
52mPasswords are Dead, Long live Passkeys!
23mOur future without passwords
31mGetting Started with Passkeys and WebAuthn
16mThe end of forgotten passwords - Biometric Authentication
37mAuthentication in 2026: A guide to passkeys, digital credentials and more