Episode 103: Passkey implementation != passkey adoption

Many passkey deployments fail to achieve the results initially expected. While passkeys are often implemented correctly from a technical standpoint, user adoption remains low. As a result, phishing risks persist, security is not improved, UX remains unchanged, and operational costs are not saved. In this episode, we’ll discuss why a shift in mindset is needed - where adoption is given as much attention as implementation - and explore strategies to drive adoption for large-scale B2C deployments.

#Speakers

• Host: Mike Schwartz, Founder/CEO Gluu
• Guest: Vincent Delitz, CoFounder of Corbado
• Guest: Andre Priebe, CTO iC Consult

#Homework

• Slides: Insights from Large-Scale B2C Passkey Deployments

#Takeaways

• Google Login? Google Passkey? Google Wallet? Do consumers really understand the differences? With the current political and economic turbulence and global warming, do people really have the attention span necessary to sort out the nuances of modern digital identity?
• The user experience for passkeys is reminiscent of smart cards--with cryptic browser messages that are too small to read. Discovery is needed--I have to know how to properly select my passkey provider. Could be hard if I don't even know what a Passkey Provider is.
• Shared passkeys like--iCloud Keychain or Google Chrome Password Manager--are only considered one factor (control of your account). Users may be perplexed why they are required to perform 2FA with a weaker credential. It can make sense--smart card + PIN number for example. But without a good explanation, it may be very confusing to end users.
• Business drivers for passkey adoption: marginal cost benefits, risk mitigation, better user experience. These aren't forcing functions for businesses to invest in passkey infrastructure right now. So security is out the window for most enterprises... with observed over-reliance on "OTP" mechanisms, like the worse offender: "email OTP"--probably the least effective mechanism for authentication ever invented, crossed with the most vulnerable to phishing-lateral movement.
• Perhaps deployment of passkeys for mobile authn--where the browser is avoided and the user experience is more controllable--is more likely.
• Passkey adoption is useless unless we actually improve the authorization infrastructure to make better policies about how and when to authenticate a person. That's why we need token based access control ("TBAC"), and the attestation JWT from the authenticator (passkey provider, token, whatever) is input to the application policy for local evaluation.