Passkey & FIDO Alliance News

October is Cybersecurity Awareness Month. Instead of another poster, here are seven identity habits for every team, each traced to something that actually happened this month: a phone call to a medical device maker, a fake AI ad portal, a national register allegedly opened with 123456, and a VPN password reused once too often.

Amazon updated its passkey announcement on October 20 to say more than 500 million customers have enabled passkeys, which it says sign in about six times faster than passwords. Passwords remain available; Amazon calls a password-free account a goal, not a current default.

At Authenticate 2026 on October 20, the FIDO Alliance said it will publish the Credential Manager Reference Architecture and a Framework for Verifier Identification in the coming weeks, and opened an External Advisory Forum for issuers, governments and regulators.

A Sapio Research survey of 700 IT and security leaders for Imprivata and the FIDO Alliance finds 95% have seen frontline workers work around authentication, 33% by sharing credentials, and only 15% use passkeys without a password. 60% report social engineering against the service desk.

FIDO's Passkey Index 2026 says 36% of successful sign-ins at 15 consumer services now use a passkey, and that passkey sign-ins succeed 93% of the time against 78% for passwords and traditional MFA. The finding that should change your rollout plan is smaller: enrolled users still get routed to the password.

The FIDO Alliance's Passkey Index 2026, built on data from 15 consumer services, finds 36% of successful sign-ins use a passkey, up from 26%, with a 93% success rate against 78% for passwords and traditional MFA. FIDO now estimates 7 billion passkeys are in use worldwide.

IDEMIA Secure Transactions launched an Agentic Commerce offering for domestic schemes and private-label issuers that combines passkey cardholder authentication with payment tokens limited by merchant, amount, category or time, plus stored proof of consent for disputes.

Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and the new federal front door runs on Login.gov. Here is how to plan the move off SMS without creating a new weak point in recovery.

From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signing in. Global Administrators and external users get until July 1. Keeping SMS means buying it from a telephony provider.

After a 300,000-user trial, GOV.UK One Login is offering passkeys to more than 23 million people across childcare, driving licences, State Pension and tax services. Nearly one in ten daily sign-ins already use one. Passwords stay optional.

GovTech has opened Singpass passkeys to Android users after an iPhone beta, with about 800,000 passkeys registered by September 9. Singpass serves 5.5 million users and over 1,400 services; passkeys stay optional and desktop support is due by end-2026.

W3C published WebAuthn Level 3 as a Recommendation on August 25, 2026. Conditional create, the Signals API, Related Origin Requests, and the PRF extension stop being working drafts and become a citable normative reference.

Amazon reports more than 175 million customers have enabled passkeys, signing in six times faster, with passkeys now the default on mobile for anyone who has set one up. The FIDO Alliance counts five billion passkeys in use industry-wide.

Three research teams broke passkey guarantees in August 2026 without touching WebAuthn. The weak points were event logs, sync key custody, and in-session key reuse. Here is what actually changed for your rollout.

Meta announced on August 25, 2026 that WhatsApp accounts can register multiple passkeys, so a user carrying both iOS and Android no longer has to bind to one ecosystem. Two-step verification also moves from a six-digit PIN to a full password.

SpecterOps, Unit 42, and Dirk-jan Mollema each demonstrated ways to defeat passkey protections without attacking WebAuthn itself, through cleartext event logs, Chrome sync key recovery, and in-session key reuse.

Dirk-jan Mollema showed that code running in a signed-in Windows session can use the victim's TPM-bound Windows Hello for Business key as a FIDO2 credential, satisfying phishing-resistant Conditional Access and acquiring a Primary Refresh Token. No admin rights, no CVE.

Our identity takeaways from Black Hat USA 2026: two independent passkey implementation attacks, a wave of AI agent identity and governance launches, an open source tool for dormant non-human identity trust paths, and insider risk getting AI-native and funded.

At Black Hat USA 2026, SpecterOps principal security researcher Michael Grafnetter presented a family of passkey attacks including cleartext YubiKey signatures readable by any authenticated user and a major cloud passkey implementation vulnerable to the exact attack it was built to stop.

Palo Alto Networks Unit 42 disclosed three attacks, Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that extract device identity keys and the master secret behind Google's synced passkeys on Windows, undermining the claim that passkey private keys cannot be copied.

Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the default in Entra ID from 1 September. Two vendors, one direction, and the desktop is the new battleground.

From September 2026 Entra ID auto-enables passkeys for users on SMS or voice. On 1 February 2027 those two methods stop working entirely, for every tenant, with no opt-out. Admins have a hard deadline and a scanner script to find who is affected.

Our takeaways from Identiverse 2026 in Las Vegas: AI agent identity moved from theory to roadmap, passkeys turned operational, deepfakes pressured identity verification, and session security took center stage.

FIDO Alliance and HID surveyed 500 IT and security decision-makers for The State of Physical and Digital Identity in the Enterprise. The headline gap: near-universal confidence in fast access revocation next to more than one in three reporting revocation delays or failures.

xMoney says it is the first Mastercard issuer to let customers create and enroll a Mastercard Payment Passkey directly inside its mobile banking app, satisfying Strong Customer Authentication while enabling Click to Pay checkout.

HID added a governance layer to its FIDO2 authenticators that checks for a certificate tying a device to a known company-issued authenticator before allowing passkey enrollment, closing the gap where employees could register personal hardware without IT's knowledge.

RSA ID Plus now covers Linux servers, developer workstations, and critical infrastructure with FIDO-based passwordless sign-in, closing the gap where organizations ran phishing-resistant authentication everywhere except the Linux estate.

From May 2025, new Microsoft accounts are created without a password at all and default to passkeys. Existing accounts keep their passwords. It is the largest default-passwordless move to date, across Windows, Microsoft 365, and Xbox sign-ins.