Passkeys and FIDO, by ear

What the FIDO Alliance is and which authentication problems its standards are meant to solve, explained by the Alliance's executive director.

Why a passkey used on its own gives stronger protection than a strong password combined with a second factor, answering a listener's common worry about losing MFA.

Why attackers increasingly bypass traditional MFA and how FIDO possession-based authentication gives IAM practitioners a phishing-resistant alternative.

Reasons passkeys and WebAuthn saw slower real-world use in 2024 than their launch publicity suggested.

Where passkey adoption stands using FIDO Passkey Index figures on eligibility and enrollment, and what counts as success in replacing passwords.

How WebAuthn and FIDO2 work, from one of the authors of the FIDO2 specifications.

What FIDO multi-device credentials, now called passkeys, are and why they were introduced as a password alternative for consumer applications.

Security and user experience trade-offs of passkeys in financial services, including how platform vendors control passkey synchronization.

How a large consumer platform implemented passkeys and what benefits it saw, told from the product manager's perspective.

How a large enterprise moved a mixed workforce of office, factory, call center and guest users to passkeys without locking people out.

Current passkey adoption levels and how the FIDO Credential Exchange Format and Protocol let users move passkeys securely between providers.

Common concerns about passkey security and adoption, discussed with the FIDO Alliance CTO, plus an overview of the Alliance's ongoing work.

How the FIDO Alliance develops standards through member-driven working groups and why that process looks different from more open standards bodies.

How passkey phishing resistance depends on browser origin binding, and how the Pass-the-Passkey attacks replayed assertions outside the browser.