Passkeys — The Real Replacement For Passwords (Mostly)

Passkeys (WebAuthn / FIDO2) are the closest the industry has gotten to "no more passwords". They're phishing-resistant, device-bound or synced, and work on every modern OS and browser.

What a passkey actually is

A keypair stored in your device's secure enclave (TouchID, Windows Hello, Android keystore) or your password manager (1Password, iCloud Keychain, Google). The server stores only the public key. Login = the device proves possession of the private key by signing a challenge — no shared secret to phish, no password to leak.

Why it beats PIN for multi-device, multi-user

Property	PIN (Track 5)	Passkey
Can be phished	Yes (typed into a fake page)	No (origin-bound by browser)
Brute-forceable	10,000 combos for 4 digits	Cryptographic key, not feasible
Per-user identity	No (shared PIN model)	Yes (each device = its own credential)
Cross-device sync	Manual (you'd have to share)	Native via iCloud / Google / 1Password
Setup complexity	5 minutes	20–60 minutes (server-side WebAuthn)
Recovery	Recovery token from Track 6	Account recovery flow + backup passkey

The honest trade-offs

Recovery is harder. Lose all your passkey-holding devices = harder to get back in. Always register at least two: e.g., laptop + phone, or a hardware key as backup.
Server complexity is real. WebAuthn ceremonies have edge cases (user verification flags, AAGUIDs, attestation). Use a library; don't roll it from spec.
Old browsers / corporate restrictions still happen. Have a fallback (PIN, email magic link) for now.

Code

Passkey registration & authentication, conceptually·python

# Registration (one-time per device)
options = generate_registration_options(
    rp_id="myapp.example.com",
    rp_name="My App",
    user_id=user.id,
    user_name=user.email,
)
# Send options to browser → navigator.credentials.create(options)
# Browser returns a credential → verify and store credential.public_key

# Authentication
options = generate_authentication_options(rp_id="myapp.example.com")
# Send to browser → navigator.credentials.get(options)
# Browser returns assertion → verify against stored public_key
# On success → issue session cookie (same model as Track 5)

Passkeys — The Real Replacement For Passwords (Mostly)

What a passkey actually is

Why it beats PIN for multi-device, multi-user

The honest trade-offs

Code

External links

Exercise

Progress

Comments 0