Passkeys are built on the FIDO2 standard (CTAP2 + WebAuthn standards). They remove the shared secret, stop phishing at the source, and make credential-stuffing useless.
But adoption is still low, and interoperability between Apple, Google, and Microsoft isn’t seamless.
I broke down how passkeys work, their strengths, and what’s still missing
You’re still transmitting the actual secret to the destination, so interception is a risk. Passkeys use asymmetric cryptography: no reusable secret is ever transmitted, only time-sensitive challenges that prove possession of the private key. Servers only store public keys, which aren’t secret by design.
Passkeys have multifactor authentication built-in whereas passwords do not.
Passkeys can be more convenient than passwords. My password manager has my passkeys. At login, my password manager raises a passkey prompt that I simply confirm.
If they can intercept my password despite TLS, they can probably also steal my session. I’ll grant that’s marginally less bad since the attacker would have to do their evil immediately if I log out when finished.
I’m going to disagree that passkeys really have multifactor authentication built in. The passkey is a single factor. If it is compromised (an attacker steals the private key), that’s all the attacker needs unless the service involved requires another factor like TOTP. The fact that it’s usually harder to steal the private key than a password doesn’t make it MFA.
I recognize the theoretical advantages, but my one attempt to use it (here, with Piefed) didn’t go so well, so I’m not eager to jump in with both feet.