{"id":82018,"date":"2024-10-11T15:11:13","date_gmt":"2024-10-11T19:11:13","guid":{"rendered":"https:\/\/fidodev.wpengine.com\/?page_id=82018"},"modified":"2025-12-12T12:37:29","modified_gmt":"2025-12-12T17:37:29","slug":"passkeys","status":"publish","type":"page","link":"https:\/\/fidoalliance.org\/passkeys\/","title":{"rendered":"Passkeys"},"content":{"rendered":"\n<p class=\"has-text-align-center\"><\/p>\n\n\n<div class=\"gb-container gb-container-284f0e35\">\n<div class=\"gb-grid-wrapper gb-grid-wrapper-1e2d8fb7\">\n<div class=\"gb-grid-column gb-grid-column-02366e3d\"><div class=\"gb-container gb-container-02366e3d\">\n\n<figure class=\"wp-block-image aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/05\/FIDO_Passkey_mark_B_white.svg\" alt=\"FIDO Alliance\" class=\"wp-image-78008\" style=\"width:128px;height:auto\"><\/figure>\n\n\n\n<p class=\"has-small-font-size\"><strong>Passkey<br><em>pass\u02cckee<\/em> noun<\/strong><\/p>\n\n<\/div><\/div>\n\n<div class=\"gb-grid-column gb-grid-column-83fa0d9a\"><div class=\"gb-container gb-container-83fa0d9a\">\n\n<p style=\"margin-right:var(--wp--preset--spacing--xx-small);margin-left:var(--wp--preset--spacing--xx-small);padding-top:0;padding-right:0;padding-bottom:0;padding-left:0\">A <em>passkey<\/em> is a FIDO authentication credential based on FIDO standards, that allows a user to sign in to apps and websites with the same process that they use to unlock their device (<a href=\"https:\/\/fidoalliance.org\/certification\/biometric-certification-process-overview\/\" data-type=\"link\" data-id=\"https:\/\/fidoalliance.org\/certification\/biometric-certification-process-overview\/\">biometrics<\/a>, PIN, or pattern). Passkeys are FIDO cryptographic credentials that are tied to a user&#8217;s account on a website or application. With passkeys, users no longer need to enter usernames and passwords or additional factors. Instead, a user approves a sign-in with the same process they use to unlock their device (for example, biometrics, PIN, pattern).<\/p>\n\n\n\n<p style=\"margin-right:var(--wp--preset--spacing--xx-small);margin-left:var(--wp--preset--spacing--xx-small);padding-top:0;padding-right:0;padding-bottom:0;padding-left:0\">The word <em>passkey<\/em> is a common noun; think of it the way you would refer to <em>password<\/em>. It should be written in lowercase except when beginning a sentence or used in a title. The term passkey (and plural form passkeys) is a cross-platform general-use term, not a feature tied to any specific platform.<\/p>\n\n<\/div><\/div>\n<\/div>\n<\/div>\n\n\n\n        <\/section>\n\n    \n\n\n<div class=\"wp-block-group is-style-default has-eggshell-background-color has-background has-global-padding is-layout-constrained wp-container-core-group-is-layout-655b25e2 wp-block-group-is-layout-constrained\" style=\"border-radius:0px;min-height:0px;margin-top:var(--wp--preset--spacing--x-small);margin-bottom:var(--wp--preset--spacing--x-small);padding-top:var(--wp--preset--spacing--xx-small);padding-right:var(--wp--preset--spacing--xx-small);padding-bottom:var(--wp--preset--spacing--xx-small);padding-left:var(--wp--preset--spacing--xx-small)\">\n<h2 class=\"wp-block-heading has-text-align-center\">Created for Security<\/h2>\n<\/div>\n\n\n\n<div class=\"wp-block-media-text is-stacked-on-mobile\" style=\"grid-template-columns:19% auto\"><figure class=\"wp-block-media-text__media\"><img loading=\"lazy\" decoding=\"async\" width=\"752\" height=\"1024\" src=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkey-login.png\" alt=\"FIDO Alliance\" class=\"wp-image-82020 size-full\" srcset=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkey-login.png 752w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkey-login-220x300.png 220w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkey-login-270x368.png 270w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkey-login-400x545.png 400w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkey-login-600x817.png 600w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkey-login-500x681.png 500w\" sizes=\"auto, (max-width: 752px) 100vw, 752px\" \/><\/figure><div class=\"wp-block-media-text__content\">\n<p>According to Verizon&#8217;s <a href=\"https:\/\/www.verizon.com\/business\/resources\/reports\/dbir\/\" target=\"_blank\" rel=\"noreferrer noopener\">2024 Data Breach Investigations Report<\/a>, <em>the overall reporting rate of phishing has been growing over the past few years. <\/em>Credential breaches and exploitation of vulnerabilities are also growing security concerns.&nbsp;<\/p>\n\n\n\n<p>Passkeys are phishing resistant and secure by design. They inherently help reduce attacks from cybercriminals such as phishing, credential stuffing, and other remote attacks. With passkeys there are no passwords to steal and there is no sign-in data that can be used to perpetuate attacks.<\/p>\n\n\n\n<p>The passkey approach provides an improved security model over traditional authentication and multi-factor authentication. Even better, passkeys are also easier for people to use and result in&nbsp; 20% more successful sign-ins over passwords. For more information, refer to <a href=\"https:\/\/passkeycentral.fidoalliance.org\/introduction-to-passkeys\/passkey-security\">Passkey Security<\/a>.<\/p>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group is-style-default has-eggshell-background-color has-background has-global-padding is-layout-constrained wp-container-core-group-is-layout-655b25e2 wp-block-group-is-layout-constrained\" style=\"border-radius:0px;min-height:0px;margin-top:var(--wp--preset--spacing--x-small);margin-bottom:var(--wp--preset--spacing--x-small);padding-top:var(--wp--preset--spacing--xx-small);padding-right:var(--wp--preset--spacing--xx-small);padding-bottom:var(--wp--preset--spacing--xx-small);padding-left:var(--wp--preset--spacing--xx-small)\">\n<h2 class=\"wp-block-heading has-text-align-center\">Easy and Fast Sign-ins<\/h2>\n<\/div>\n\n\n\n<div class=\"wp-block-media-text is-stacked-on-mobile\" style=\"grid-template-columns:19% auto\"><figure class=\"wp-block-media-text__media\"><img loading=\"lazy\" decoding=\"async\" width=\"209\" height=\"90\" src=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/05\/Password-e1715722310252.png\" alt=\"FIDO Alliance\" class=\"wp-image-78410 size-full\"><\/figure><div class=\"wp-block-media-text__content\">\n<p>FIDO authentication is easy to use. People and organizations are rapidly adopting passkeys. In a recent independent survey commissioned by the <a href=\"\/\">FIDO Alliance<\/a>, 53% of people <a href=\"https:\/\/fidoalliance.org\/content-ebook-consumer-password-and-passkey-trends-wpd-2024\/\" target=\"_blank\" rel=\"noreferrer noopener\">reported<\/a> enabling passkeys on at least one of their accounts, with 22% enabling them on every account they possibly can.<\/p>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group is-style-default has-eggshell-background-color has-background has-global-padding is-layout-constrained wp-container-core-group-is-layout-655b25e2 wp-block-group-is-layout-constrained\" style=\"border-radius:0px;min-height:0px;margin-top:var(--wp--preset--spacing--x-small);margin-bottom:var(--wp--preset--spacing--x-small);padding-top:var(--wp--preset--spacing--xx-small);padding-right:var(--wp--preset--spacing--xx-small);padding-bottom:var(--wp--preset--spacing--xx-small);padding-left:var(--wp--preset--spacing--xx-small)\">\n<h2 class=\"wp-block-heading has-text-align-center\">Benefits of Passkeys<\/h2>\n<\/div>\n\n\n\n<p>Organizations who implement support for passkeys see the following benefits as passkey use increases:<\/p>\n\n\n\n<div class=\"wp-block-media-text alignfull is-stacked-on-mobile is-vertically-aligned-center\" style=\"grid-template-columns:18% auto\"><figure class=\"wp-block-media-text__media\"><img loading=\"lazy\" decoding=\"async\" width=\"326\" height=\"293\" src=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkeys-101.png\" alt=\"FIDO Alliance\" class=\"wp-image-82043 size-full\" srcset=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkeys-101.png 326w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkeys-101-300x270.png 300w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/passkeys-101-270x243.png 270w\" sizes=\"auto, (max-width: 326px) 100vw, 326px\" \/><\/figure><div class=\"wp-block-media-text__content\">\n<h3 class=\"wp-block-heading\">Improvements for the end user experience<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Higher sign-in success rates<\/li>\n\n\n\n<li>Faster time to sign in<\/li>\n\n\n\n<li>Safer, more secure, and faster online experiences<\/li>\n\n\n\n<li>Cross-device and ecosystem availability<\/li>\n<\/ul>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-media-text alignfull is-stacked-on-mobile is-vertically-aligned-center\" style=\"grid-template-columns:18% auto\"><figure class=\"wp-block-media-text__media\"><img loading=\"lazy\" decoding=\"async\" width=\"348\" height=\"318\" src=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/02\/Enterprise_Implement_top-hero.png\" alt=\"FIDO Alliance\" class=\"wp-image-71891 size-full\" srcset=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/02\/Enterprise_Implement_top-hero.png 348w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/02\/Enterprise_Implement_top-hero-300x274.png 300w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/02\/Enterprise_Implement_top-hero-270x247.png 270w\" sizes=\"auto, (max-width: 348px) 100vw, 348px\" \/><\/figure><div class=\"wp-block-media-text__content\">\n<h3 class=\"wp-block-heading\">Business improvements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Higher sign-in success rate, higher conversions, repeat purchases, and less downtime<\/li>\n\n\n\n<li>Reductions in phishing, credential stuffing, and attack surface<\/li>\n\n\n\n<li>Lower rate of cart abandonment<\/li>\n\n\n\n<li>Reduction in need for password resets during account recovery<\/li>\n\n\n\n<li>Decrease in need for customer support<\/li>\n\n\n\n<li>Increase in customer loyalty and retention<\/li>\n<\/ul>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-media-text alignfull is-stacked-on-mobile is-vertically-aligned-center\" style=\"grid-template-columns:18% auto\"><figure class=\"wp-block-media-text__media\"><img loading=\"lazy\" decoding=\"async\" width=\"418\" height=\"417\" src=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/icon_lock.png\" alt=\"FIDO Alliance\" class=\"wp-image-82038 size-full\" srcset=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/icon_lock.png 418w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/icon_lock-300x300.png 300w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/icon_lock-150x150.png 150w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/icon_lock-270x269.png 270w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/icon_lock-400x399.png 400w\" sizes=\"auto, (max-width: 418px) 100vw, 418px\" \/><\/figure><div class=\"wp-block-media-text__content\">\n<h3 class=\"wp-block-heading\">Lower costs associated with:<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Service costs for authentication methods such as SMS text messages<\/li>\n\n\n\n<li>Monitoring and defending malicious actors in real-time<\/li>\n\n\n\n<li>Continuous hardening of traditional authentication solutions<\/li>\n\n\n\n<li>Account reset due to forgot password and account lockout<\/li>\n<\/ul>\n<\/div><\/div>\n\n\n\n<p>From these examples, you can see that passkeys benefit both your organization and your end users.&nbsp;<\/p>\n\n\n\n<p>You can view the latest user adoption trends <a href=\"https:\/\/fidoalliance.org\/content\/research\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/fidoalliance.org\/content\/research\/<\/a><\/p>\n\n\n\n<div class=\"wp-block-group is-style-default has-eggshell-background-color has-background has-global-padding is-layout-constrained wp-container-core-group-is-layout-655b25e2 wp-block-group-is-layout-constrained\" style=\"border-radius:0px;min-height:0px;margin-top:var(--wp--preset--spacing--x-small);margin-bottom:var(--wp--preset--spacing--x-small);padding-top:var(--wp--preset--spacing--xx-small);padding-right:var(--wp--preset--spacing--xx-small);padding-bottom:var(--wp--preset--spacing--xx-small);padding-left:var(--wp--preset--spacing--xx-small)\">\n<h2 class=\"wp-block-heading has-text-align-center\">Get Started with Passkeys<\/h2>\n<\/div>\n\n\n\n<p>FIDO offers multiple resources related to passkeys. Here are some places to start as you explore passkeys and to help when you\u2019re ready to implement support for passkeys.&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/www.passkeycentral.org\/home\" target=\"_blank\" rel=\"noreferrer noopener\">Passkey Central<\/a><\/strong> &#8211; A public resource for stakeholders seeking to learn more about how to use passkeys.<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/fidoalliance.org\/passkey-use-cases\/\" target=\"_blank\" rel=\"noreferrer noopener\">Use Cases<\/a><\/strong> &#8211; Reference to learn about the various passkey use cases.<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/www.passkeycentral.org\/design-guidelines\/\" target=\"_blank\" rel=\"noreferrer noopener\">Design Guidelines<\/a><\/strong> &#8211; Design Guidelines that center around design patterns for consumer use cases of passkeys.<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/fidoalliance.org\/passkeys-directory\/\" target=\"_blank\" rel=\"noreferrer noopener\">Passkey Directory<\/a><\/strong> &#8211; Learn how businesses and organizations have leveraged FIDO standards to create passwordless authentication to provide secure logins for their employees and clients.<\/li>\n\n\n\n<li><a href=\"https:\/\/fidoalliance.org\/get-the-passkey-icon\/\" target=\"_blank\" rel=\"noreferrer noopener\">Get the FIDO Passkey Icon<\/a> &#8211; The passkey icon indicates to users that they can securely and easily sign in to their website or app without passwords.<\/li>\n\n\n\n<li><strong><a previewlistener=\"true\" href=\"https:\/\/fidoalliance.org\/fido-alliance-passkeys-explainer-video\/\" target=\"_blank\" rel=\"noreferrer noopener\">Passkeys Explainer Video<\/a><\/strong> &#8211; Watch the 2024 passkeys explainer video to help you get started with passkeys.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-group has-emerald-background-color has-background has-global-padding is-layout-constrained wp-container-core-group-is-layout-8217c53c wp-block-group-is-layout-constrained\" style=\"padding-top:var(--wp--preset--spacing--medium);padding-right:var(--wp--preset--spacing--medium);padding-bottom:var(--wp--preset--spacing--medium);padding-left:var(--wp--preset--spacing--medium)\">\n<h3 class=\"wp-block-heading has-text-align-center has-base-color has-text-color has-link-color wp-elements-2979add87dedf67bfd964dd8c29175d8\">Visit passkeycentral.org Today<\/h3>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-a89b3969 wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-base-color has-text-color has-link-color wp-element-button\" href=\"https:\/\/www.passkeycentral.org\/home\" target=\"_blank\" rel=\"noreferrer noopener\">Passkey Central<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading has-teal-color has-text-color has-link-color wp-elements-330bfd7dce150e4529edfde080cb09da\" id=\"PasskeysFAQs\">Passkeys FAQ<\/h2>\n\n\n<div class=\"gb-container gb-container-14fa1fe2 gb-accordion\">\n<div class=\"gb-container gb-container-0485e242 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-3114a16f gb-accordion__toggle\" id=\"gb-accordion-toggle-3114a16f\"><span class=\"gb-button-text\">WHAT IS A PASSKEY?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-1021949e\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-1021949e\">\n\n<p>Passkeys are a password replacement technology.<\/p>\n\n\n\n<p>A password is something that can be remembered and typed, and a passkey is a secret stored on one\u2019s devices, unlocked by the user the same way they unlock their device (biometrics, PIN, pattern, etc.).<\/p>\n\n\n\n<p>Unlike passwords, passkeys are resistant to phishing, are always strong, and are designed so that there are no shared secrets.<\/p>\n\n\n\n<p>Passkeys simplify account registration for apps and websites, are easy to use, work across all of a user\u2019s devices, and even other devices within physical proximity.<\/p>\n\n\n\n<p>From a technical standpoint, passkeys are FIDO credentials for passwordless authentication. Passkeys replace passwords with cryptographic key pairs for phishing-resistant sign-in security and an improved user experience. The cryptographic keys are used from end-user devices (computers, phones, or security keys) for user authentication. Passkeys can be securely synced across a user\u2019s devices, or bound to a particular device (device-bound passkeys).<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-b96681fc gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-f7dc9163 gb-accordion__toggle\" id=\"gb-accordion-toggle-f7dc9163\"><span class=\"gb-button-text\">HOW DOES A USER EXPERIENCE PASSKEYS?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-811f4869\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-811f4869\">\n\n<p>When a user is asked to sign in to an app or website, the user approves the sign-in with the same biometric or PIN or on-device password that the user has to unlock their device (phone, computer, or&nbsp;security key). The app or website can use this mechanism instead of the traditional username and password.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-4466d6b5 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-a8c42575 gb-accordion__toggle\" id=\"gb-accordion-toggle-a8c42575\"><span class=\"gb-button-text\">ARE PASSKEYS A NEW SPECIFICATION OR STANDARD FROM FIDO ALLIANCE?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-d8b4a743\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-d8b4a743\">\n\n<p>The same standards, commonly known as FIDO2 (WebAuthn and CTAP), are leveraged to deploy FIDO with passkeys for sign-in. The WebAuthn standard covers the browser API that manages passkeys.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-760a15c7 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-c78bbb03 gb-accordion__toggle\" id=\"gb-accordion-toggle-c78bbb03\"><span class=\"gb-button-text\">HOW SHOULD I USE THE WORD PASSKEY?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-53a6b651\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-53a6b651\">\n\n<p>The word \u201cpasskey\u201d is a common noun; think of it the way you would refer to \u201cpassword\u201d. It should be written in lowercase except when beginning a sentence.&nbsp;<\/p>\n\n\n\n<p>The term \u201cpasskey\u201d (and plural form \u201cpasskeys\u201d) is a cross-platform general-use term, not a feature tied to any specific platform.<\/p>\n\n\n\n<p>When delineation is required, passkeys that are synced between user\u2019s devices via a cloud service are generally referred to as \u201csynced passkeys\u201d, and those that never leave a single device (including those on UAF apps) are referred to as \u201cdevice-bound passkeys.\u201d<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-536f7c35 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-2cdbe7b9 gb-accordion__toggle\" id=\"gb-accordion-toggle-2cdbe7b9\"><span class=\"gb-button-text\">IS THE USER&#8217;S BIOMETRIC INFORMATION SAFE WHEN SIGNING IN WITH A PASSKEY?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-16e555c4\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-16e555c4\">\n\n<p>Yes. There is no change to the local biometric processing that the user devices (mobile phones, computers, security keys) do today. Biometric information and processing continues to stay on the device and is never sent to any remote server \u2014 the server only sees an assurance that the biometric check was successful.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-1c0e57c4 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-e739090b gb-accordion__toggle\" id=\"gb-accordion-toggle-e739090b\"><span class=\"gb-button-text\">WHAT ARE THE USE CASES FOR PASSKEYS?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-821b123f\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-821b123f\">\n\n<p>The primary use case for passkeys is replacing the password as the first\/primary factor for account authentication. Since passkeys are phishing-resistant and easy to use, they also can replace legacy multi-factor authentication flows, such as password plus SMS OTP. There are other use cases for passkeys, such as in online payment scenarios, within identity wallets, and for automotive, to name a few.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-e6a0e356 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-6ebeb26d gb-accordion__toggle\" id=\"gb-accordion-toggle-6ebeb26d\"><span class=\"gb-button-text\">WHY ARE PASSKEYS BETTER THAN PASSWORD + SECOND FACTOR?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-a4fc9b8e\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-a4fc9b8e\">\n\n<p>For years, passwords have been subject to phishing attacks and credential stuffing attacks, due to the prevalence of password reuse and database breaches.<\/p>\n\n\n\n<p>Because the primary factor \u2014 the password \u2014 is fundamentally broken in multiple ways, the industry has seen widespread adoption of layering on an additional second factor. But unfortunately the most popular forms of second factors \u2014 such as one time passwords (OTPs) and phone approvals \u2014 are both inconvenient and still phishable.&nbsp;<\/p>\n\n\n\n<p>Passkeys are a primary factor that \u2014 standing alone \u2014 are more secure than the combination of either \u201cpassword + OTP\u201d or \u201cpassword + phone approval\u201d.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-77c294c9 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-a966eb73 gb-accordion__toggle\" id=\"gb-accordion-toggle-a966eb73\"><span class=\"gb-button-text\">WHAT IS A PASSKEY PROVIDER?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-5cb60169\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-5cb60169\">\n\n<p>A passkey provider is responsible for the creation and passkey management of a user&#8217;s passkeys. A passkey provider can be a browser or operating system vendor where passkeys are stored and synced within the built in credential manager (such as iCloud keychain or Google password manager), or a third party provider where passkeys are stored and synced within a third party app or browser extension (such as 1Password or Dashlane).<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-063b469b gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-9aae8318 gb-accordion__toggle\" id=\"gb-accordion-toggle-9aae8318\"><span class=\"gb-button-text\">IS SYNCING PASSKEYS SECURE?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-9d5b12fd\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-9d5b12fd\">\n\n<p>Yes. Passkey syncing is end-to-end encrypted, and passkey providers have strong account security protections.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-5bcd4f73 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-884fb018 gb-accordion__toggle\" id=\"gb-accordion-toggle-884fb018\"><span class=\"gb-button-text\">WHAT BENEFITS DO SYNCING PASSKEYS PROVIDE?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-f1bc236c\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-f1bc236c\">\n\n<p>Syncing is critically important for the FIDO Alliance to achieve its mission, which is to make sign-in easier and fundamentally safer by replacing passwords in as many places as possible.<\/p>\n\n\n\n<p>This is because\u00a0<strong>password replacement technology<\/strong>\u00a0means \u201ccompeting\u201d with passwords across three dimensions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Speed<\/strong>: should be faster than creating or using a password.<\/li>\n\n\n\n<li><strong>Convenience<\/strong>: should be at least equally as convenient \u2014 if not more convenient \u2014 than using a password.<\/li>\n\n\n\n<li><strong>Security<\/strong>: should be phishing-resistant, and should be guaranteed to be unique per app\/website\/service.<\/li>\n<\/ul>\n\n\n\n<p><strong>Speed<\/strong><br>The creation of passkeys eliminates the need for users to comply with password complexity requirements. Registration is as simple as a biometric auth or entering a PIN code, and subsequent sign-in attempts with a passkey again only require a biometric authentication or PIN code \u2014 both faster than typing in a password.<\/p>\n\n\n\n<p><strong>Convenience<\/strong><br>The usability of password replacement technology must compete with the convenience of passwords, and one of the primary usability benefits of passwords is that they can be used from any device.<\/p>\n\n\n\n<p>Syncing means that passkeys are available from all of a user\u2019s devices using the same passkey provider. And just like passwords, visiting a website from another device does not require going through a credential registration\/creation flow \u2014 cross-device sign-in is supported via an enhancement to the FIDO Alliance Client to Authenticator Protocol (CTAP) that uses Bluetooth Low Energy (BLE) to verify physical proximity.<\/p>\n\n\n\n<p>If the cryptographic key is bound to the user\u2019s computer or mobile device, then every time the user gets a new device, the RP would have to fall back to other methods of authentication (typically a knowledge-based credential such as a password). In practice, this often means that the first sign-in on a new device will be inconvenient and phishable.<\/p>\n\n\n\n<p>Passkeys solve this issue because they are available on the user\u2019s device if and when the user needs them \u2014&nbsp;<strong>starting from the very first sign-in to a website from that device<\/strong>. Lastly, users often forget passwords and don\u2019t set up backup emails and phone numbers. With passkeys, as long as the user has their device, they can sign in; there is nothing to forget. Because passkeys can be backed up, they can be better protected from loss.<\/p>\n\n\n\n<p><strong>Security<\/strong><br>Passkeys, which are FIDO credentials, allow relying parties (which face a constant threat of phishing, credential stuffing, password database breaches, etc.) to replace passwords with FIDO credentials. FIDO offers relying parties a challenge-response authentication protocol based on asymmetric cryptography. This means phishing-resistance, and the elimination of sensitive secrets on the server, resulting in a huge step forward in security.<\/p>\n\n\n\n<p>Phishing resistance is a core design goal of FIDO Authentication. This goal is achieved at sign-in whether or not the cryptographic keys are bound to hardware. Furthermore, breaches of password databases (which can be an attractive target for hackers) no longer pose a threat as there are no passwords to steal.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-c0851c2e gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-017fa397 gb-accordion__toggle\" id=\"gb-accordion-toggle-017fa397\"><span class=\"gb-button-text\">HOW DOES AN ONLINE SERVICE (AKA &#8220;RELYING PARTY [RP]&#8221;) IMPLEMENT PASSKEYS FOR THEIR USERS TO AUTHENTICATE?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-6e2722b9\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-6e2722b9\">\n\n<p>RPs use the built-in WebAuthn API (for websites) and platform FIDO APIs (for apps) to exercise passkeys for sign-in.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-2dc7f0f3 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-dce297c5 gb-accordion__toggle\" id=\"gb-accordion-toggle-dce297c5\"><span class=\"gb-button-text\">WHAT IS THE AVAILABILITY OF PASSKEYS ACROSS VARIOUS OS PLATFORMS?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-3315292e\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-3315292e\">\n\n<p>Passkeys are supported in all major operating systems, internet browsers, and by third-party passkey providers.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-ffc4e338 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-1ba4b58e gb-accordion__toggle\" id=\"gb-accordion-toggle-1ba4b58e\"><span class=\"gb-button-text\">HOW DOES A PASSKEY BECOME AVAILABLE ACROSS A USER&#8217;S DEVICES?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-48260cc7\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-48260cc7\">\n\n<p>When a user creates a passkey on any of their devices, it gets synced to all the user\u2019s other devices using the same passkey provider that is also signed into the same user\u2019s account. Thus, passkeys created on one device become available on all devices.<\/p>\n\n\n\n<p>Notably, if the user gets a new device and sets it up with their passkey provider, the user\u2019s passkeys are synced and available for sign-in on the new device.<\/p>\n\n<\/div><\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-top:0;margin-bottom:0;padding-top:0;padding-bottom:0\"><div class=\"gb-container gb-container-99d5d010 gb-accordion\">\n<div class=\"gb-container gb-container-7303905f gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-48bbfa31 gb-accordion__toggle\" id=\"gb-accordion-toggle-48bbfa31\"><span class=\"gb-button-text\">HOW DOES THE USER SIGN IN IF A PASSKEY FOR THE RP IS NOT ALREADY AVAILABLE ON THE DEVICE?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-b91cdc90\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-b91cdc90\">\n\n<p>FIDO has defined cross-device authentication for this use case. Cross device authentication allows a user to sign in with their device using a QR code.&nbsp;<\/p>\n\n\n\n<p>FIDO Cross-Device Authentication (CDA) allows a passkey from one device to be used to sign in on another device. For example, your phone can be linked to your laptop, allowing you to use a passkey from your phone to sign into a service on your laptop.<\/p>\n\n\n\n<p>CDA is powered by the FIDO Client-to-Authenticator Protocol (CTAP) using \u201chybrid\u201d transport. CTAP is implemented by authenticators and client platforms, not Relying Parties.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"590\" src=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-1024x590.png\" alt=\"FIDO Alliance\" class=\"wp-image-82288\" srcset=\"https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-1024x590.png 1024w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-300x173.png 300w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-768x443.png 768w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-1536x886.png 1536w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-2048x1181.png 2048w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-270x156.png 270w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-400x231.png 400w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-600x346.png 600w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-1280x738.png 1280w, https:\/\/fidoalliance.org\/wp-content\/uploads\/2024\/10\/Cross-Device-Authentication-FIDO-Alliance-500x288.png 500w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-00851f52 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-c4ed4c07 gb-accordion__toggle\" id=\"gb-accordion-toggle-c4ed4c07\"><span class=\"gb-button-text\">IS FIDO CROSS-DEVICE AUTHENTICATION SAFE USING BLUETOOTH?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-691d94a3\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-691d94a3\">\n\n<p>The FIDO Cross-Device Authentication flow, which leverages CTAP 2.2, uses Bluetooth Low Energy (BLE) to verify physical proximity, but does not depend on Bluetooth security properties for the actual security of the sign-in. The CTAP transport, named \u2018hybrid\u2019, uses an additional layer of standard cryptographic techniques \u2014&nbsp;on top of standard Bluetooth security properties \u2014 to protect data.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-3fcfcca6 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-a2f83ed6 gb-accordion__toggle\" id=\"gb-accordion-toggle-a2f83ed6\"><span class=\"gb-button-text\">ARE PASSKEYS CONSIDERED MULTI-FACTOR AUTHENTICATION?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-39044830\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-39044830\">\n\n<p>Passkeys leverage multiple factors for authentication: the passkeys are kept on a user\u2019s devices (something the user \u201chas\u201d) and \u2014 if the RP requests User Verification \u2014 can only be exercised by the user with a biometric or PIN (something the user \u201cis\u201d or \u201dknows\u201d).&nbsp;<\/p>\n\n\n\n<p>RPs may be concerned that a passkey could be made available to an attacker through a single factor (say, a password) from the passkey provider account. In practice, however, this is not usually the case: passkey providers consider multiple signals beyond the user\u2019s password \u2014 some visible to the user, some not \u2014 when authenticating users and restoring passkeys to their devices.<\/p>\n\n\n\n<p>Note that some regulatory regimes still have to evolve to recognize passkeys as one of the officially listed forms of multi-factor. This is an area of active engagement for the FIDO Alliance.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-1f89b9c5 gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-31c80e9d gb-accordion__toggle\" id=\"gb-accordion-toggle-31c80e9d\"><span class=\"gb-button-text\">HOW CAN A USER SWITCH TO A NEW MOBILE PLATFORM AS THE SIGN-IN DEVICE (E.G., FROM ANDROID TO IOS OR VICE VERSA)?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-1bf835bd\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-1bf835bd\">\n\n<p>If a user utilizes a cross-platform passkey provider like Google Password Manager or Bitwarden, configuring the provider on their new device will make their passkeys available on that device.<\/p>\n\n\n\n<p>If the user stores their passkeys on a FIDO Security Key, they can use it to securely authenticate on the new device.<\/p>\n\n\n\n<p>If the user is not using a cross-platform passkey provider and is still in possession of their old device, the user can use the passkey on the old device (say, an iOS device) to sign the user into their account on the new device (say, an Android device). Once signed in, the user can create a passkey in the new device&#8217;s provider.<\/p>\n\n\n\n<p>In other cases, the RP can treat sign-in from the new device (which might be from a different vendor) as a normal account recovery situation and take appropriate steps to get the user signed in.<\/p>\n\n<\/div><\/div>\n<\/div>\n\n<div class=\"gb-container gb-container-77015bdf gb-accordion__item\" data-transition=\"slide\">\n\n<button class=\"gb-button gb-button-904824d8 gb-accordion__toggle\" id=\"gb-accordion-toggle-904824d8\"><span class=\"gb-button-text\">CAN FIDO SECURITY KEYS SUPPORT PASSKEYS?<\/span><span class=\"gb-icon\"><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon\"><path d=\"M207.029 381.476L12.686 187.132c-9.373-9.373-9.373-24.569 0-33.941l22.667-22.667c9.357-9.357 24.522-9.375 33.901-.04L224 284.505l154.745-154.021c9.379-9.335 24.544-9.317 33.901.04l22.667 22.667c9.373 9.373 9.373 24.569 0 33.941L240.971 381.476c-9.373 9.372-24.569 9.372-33.942 0z\" fill=\"currentColor\"><\/path><\/svg><svg xmlns=\"https:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 448 512\" width=\"1em\" height=\"1em\" ariahidden=\"true\" role=\"img\" class=\"gb-accordion__icon-open\"><path d=\"M240.971 130.524l194.343 194.343c9.373 9.373 9.373 24.569 0 33.941l-22.667 22.667c-9.357 9.357-24.522 9.375-33.901.04L224 227.495 69.255 381.516c-9.379 9.335-24.544 9.317-33.901-.04l-22.667-22.667c-9.373-9.373-9.373-24.569 0-33.941L207.03 130.525c9.372-9.373 24.568-9.373 33.941-.001z\" fill=\"currentColor\"><\/path><\/svg><\/span><\/button>\n\n\n<div id=\"gb-accordion-content-844cb872\" class=\"gb-accordion__content\"><div class=\"gb-container gb-container-844cb872\">\n\n<p>Yes, FIDO Security Keys today can house device-bound passkeys and have done so since 2019, when FIDO2 added support for passwordless sign-ins via discoverable credentials with user verification. All the client platforms and browsers have native support to exercise security keys already. Security key vendors may choose to support passkey synchronization in the future.<\/p>\n\n\n\n<p>Since all passkeys are FIDO credentials, a web service implementing support for FIDO will be able to support all passkey implementations.<\/p>\n\n\n\n<p>Specific environments with particular compliance needs may be required to guarantee there is only one copy of the cryptographic key available. Passkeys on FIDO Security Keys are a great solution for such use cases.<\/p>\n\n\n\n<p>Also, in scenarios where a user has lost access to all of their other mobile and other devices where their passkeys have been synced, such FIDO security keys can act as a recovery credential.<\/p>\n\n<\/div><\/div>\n<\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Created for Security According to Verizon&#8217;s 2024 Data Breach Investigations Report, the overall reporting rate of phishing has been growing over the past few years. Credential breaches and exploitation of [&hellip;]<\/p>\n","protected":false},"author":72,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"_EventAllDay":false,"_EventTimezone":"","_EventStartDate":"","_EventEndDate":"","_EventStartDateUTC":"","_EventEndDateUTC":"","_EventShowMap":false,"_EventShowMapLink":false,"_EventURL":"","_EventCost":"","_EventCostDescription":"","_EventCurrencySymbol":"","_EventCurrencyCode":"","_EventCurrencyPosition":"","_EventDateTimeSeparator":"","_EventTimeRangeSeparator":"","_EventOrganizerID":[],"_EventVenueID":[],"_OrganizerEmail":"","_OrganizerPhone":"","_OrganizerWebsite":"","_VenueAddress":"","_VenueCity":"","_VenueCountry":"","_VenueProvince":"","_VenueState":"","_VenueZip":"","_VenuePhone":"","_VenueURL":"","_VenueStateProvince":"","_VenueLat":"","_VenueLng":"","_VenueShowMap":false,"_VenueShowMapLink":false,"footnotes":""},"content-type":[],"class_list":["post-82018","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/fidoalliance.org\/wp-json\/wp\/v2\/pages\/82018","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fidoalliance.org\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/fidoalliance.org\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/fidoalliance.org\/wp-json\/wp\/v2\/users\/72"}],"replies":[{"embeddable":true,"href":"https:\/\/fidoalliance.org\/wp-json\/wp\/v2\/comments?post=82018"}],"version-history":[{"count":0,"href":"https:\/\/fidoalliance.org\/wp-json\/wp\/v2\/pages\/82018\/revisions"}],"wp:attachment":[{"href":"https:\/\/fidoalliance.org\/wp-json\/wp\/v2\/media?parent=82018"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/fidoalliance.org\/wp-json\/wp\/v2\/content-type?post=82018"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}