Passkey - Revision history

Tom: /* Support Infrastructure */

2025-12-16T01:35:36Z

‎Support Infrastructure

2025-12-16T01:33:15Z

‎Problems

2025-05-21T04:29:49Z

‎Multi Device Passkeys

2025-05-21T04:28:36Z

‎Features

2025-05-01T17:36:44Z

‎Solutions

2025-01-24T20:24:35Z

‎Solutions

2025-01-24T20:23:41Z

‎Solutions

2024-09-17T01:09:04Z

‎Features

2024-09-17T01:08:37Z

‎Features

2024-09-17T01:04:26Z

‎Acceptance

@@ Line 45: / Line 45: @@
 If you're evaluating passkeys, these 5 realities will decide whether your rollout succeeds or stalls:
+[[File:Banks passkeys.jpg|777px]]
 ====Post-Login" mindset in native apps:====

@@ Line 35: / Line 35: @@
 * [https://github.com/passkeydeveloper/passkeys.dev/issues/363 Misconceptions about passkeys] or not?
 * FIDO requires secure origin binding and TLS. But that is not accessible to all password managers, so a man-in-the-middle-attack only requires spoofing the origin to be part of the origin used for the key. (in other words, the FIDO binding does not seem to apply to what happens in the xxx-manager unless the xxx-manager is fully integrated into a browser that is FIDO compliant)
 ==Acceptance==

@@ Line 25: / Line 25: @@
 * 2025-05 [https://developers.yubico.com/Passkeys/Passkey_concepts/Single_device_vs_multi_device_credentials.html Single device vs multi device credentials] Yubikey
 * 2024-09, passkeys can be synced within the ecosystems of Google, Apple, and Microsoft, but cross-platform synchronization (between Google, Apple, and Microsoft) is not yet fully supported. Each company has its own system for managing and syncing passkeys:
-* Google: Passkeys are synced across devices using Google Password Manager.
+** Google: Passkeys are synced across devices using Google Password Manager.
-* Apple: Passkeys are synced across Apple devices using iCloud Keychain.
+** Apple: Passkeys are synced across Apple devices using iCloud Keychain.
-* Microsoft: Passkeys are managed and synced through Windows Hello.
+** Microsoft: Passkeys are managed and synced through Windows Hello.
-While the FIDO Alliance is working towards a unified standard for password-less authentication, full interoperability between these ecosystems is still in progress. For now, you’ll need to manage passkeys separately within each ecosystem.
+** While the FIDO Alliance is working towards a unified standard for password-less authentication, full interoperability between these ecosystems is still in progress. For now, you’ll need to manage passkeys separately within each ecosystem.
 ==Problems==

@@ Line 22: / Line 22: @@
 * [[Passkey]]s since 2024 can be synced between devices that have enabled syncing. This feature can be blocked by using device-bound [[Passkey]]s. Multi-device credentials had been the name on introduction to distinguish it from the original device-bound  [[Passkey]].
 * The user must unlock the passkey on the device before it is used. Typically a [[Biometric Factor]] or pin is used as a second [[Authentication Factor]].
-On 2024-09, passkeys can be synced within the ecosystems of Google, Apple, and Microsoft, but cross-platform synchronization (between Google, Apple, and Microsoft) is not yet fully supported. Each company has its own system for managing and syncing passkeys:
+===Multi Device Passkeys===
 * Google: Passkeys are synced across devices using Google Password Manager.
 * Apple: Passkeys are synced across Apple devices using iCloud Keychain.

@@ Line 40: / Line 40: @@
 ==Solutions==
 * 25-01 [https://newsroom.paypal-corp.com/2025-01-23-Solving-the-Convenience-and-Security-Equation Paypal promotes passkeys for payments.]
 * 24-09 [https://web.dev/articles/webauthn-related-origin-requests Allow passkey reuse across your sites with Related Origin Requests] but what, exactly, is a related origin?  See wiki page [[Browser Origin Policy]].

@@ Line 44: / Line 44: @@
 * 24-08-08 [https://www.cisa.gov/resources-tools/resources/secure-demand-guide New CISA Guide Calls for Phishing-Resistant Forms of Authentication and Passkeys by Default].
 * 24-08-05 passkeys.dev now has a hashtag#WebAuthn feature detection page for developers! This page will check for common features and capabilities used with hashtag#passkeys in the browser where it was loaded! Check it out [https://featuredetect.passkeys.dev/ WebAuthn Features and Capability Detection]] (short URL is passkeys.dev/fd)
-* 24-08-04 Chrome on Android now integrates the Credential Manager allowing third-party password managers provide passkeys on Android 14 and later.
+* 24-08-04 Chrome on Android now integrates the Credential Manager allowing third-party password managers provide passkeys on Android 14 and later. With this update, your Chrome on Android 14 and later can create and save a passkey to a third-party password manager, or authenticate using a passkey saved there. Also, learn how a relying party can detect which password manager a passkey is created at.<ref>Eiji Kitaura, ''Passkeys UX updates on Chrome on Android'' https://developer.chrome.com/blog/passkeys-on-credential-manager</ref>
 ===Portability===
 Vendor Relationship Management (via Doc Searls) is coming true but it is fully hidden behind terms like:

@@ Line 32: / Line 32: @@
 * Passkeys support by both Apple and Google. See the [https://passkeys.dev/ website] for details.
 * By the end of 2023 it looks like more people are using passkeys than expected.<ref>Lewis Maddison, ''Looks like more people are using passkeys than expected 1Password sees passkeys exceed 700k'' (2023-12-21) https://www.techradar.com/pro/security/looks-like-more-people-are-using-passkeys-than-expected</ref> <blockquote>1Password experienced a particular spike in October 2023, correlating with big companies like Amazon and WhatsApp rolling out their support for passkeys during this month, with over 70,000 created between October 16-22 alone.</blockquote>
 ==Solutions==
 * 24-09 [https://web.dev/articles/webauthn-related-origin-requests Allow passkey reuse across your sites with Related Origin Requests] but what, exactly, is a related origin?  See wiki page [[Browser Origin Policy]].