A recent video highlights a new approach to passkey management. According to the video:

This new process is fundamentally different and more secure than traditional credential export methods, which often involve exporting an unencrypted CSV or JSON file, then manually importing it into another app. The transfer process is user initiated, occurs directly between participating credential manager apps and is secured by local authentication like Face ID.

The video further explains that the transfer uses a data schema developed with the FIDO Alliance, standardizing data formats for passkeys, passwords, and verification codes.The system aims to provide a secure mechanism for moving data between apps, eliminating the risk of credential leaks from insecure files.

The Drive for Passkeys

The increasing adoption of passkeys is largely due to the important problems and expenses associated with traditional passwords. Many users find it difficult to create and manage strong, unique passwords for each account, often leading to weak or reused passwords. Password leaks have also become a persistent security issue.

This design ensures that there is no shared secret that ever leaves the user’s device.

Passkeys are designed to be resistant to credential phishing, password leaks, and password spraying.Using the FIDO2 specification,a unique public/private encryption keypair is created during enrollment with each website or app. These keys are generated and stored on the user’s device, such as a phone, computer, or YubiKey. The public key is sent to the account service, while the private key remains on the user’s device and cannot be extracted. During sign-in, the server sends a challenge to the device, which signs it using the private key to authenticate the user.

This method ensures that no shared secret ever leaves the user’s device, preventing data from being intercepted, phished, or compromised.

Usability Challenges and Progress

One major obstacle to passkey adoption has been usability. As previously noted, apps, operating systems, and websites often operate independently, creating a lack of interoperability. This can lock users out of their accounts and make passkeys too complex for many people.

Apple’s recent demonstration suggests that passkey developers are making significant strides in improving usability and cross-platform compatibility.