A Beginner's Deep Dive Guide to Entra Passkeys

It can be distracting. You have social media, messages and apps on the same device you need to login. Already makes it harder to put away the phone for a while.

It can never be "cold": You have your phone always with you, which means the risk of it being stolen or lost is higher than with something you can keep in your desk drawer for 99% of the time.

It's a single point of failure: If you should lose it, you potentially have a huge problem: You're right that a thief couldn't make much use of it and we have sophisticated tech to remote-lock and locate phones now. But that won't help you if you need your phone to log into your Google or Apple account to access that tech in the first place.

(Yes, I know there alternative ways to regain access to Apple or Google accounts, but those all rely on you having something... not on your phone)

I don't really own the phone. I know it's paranoid, but I don't like the idea of some update being able to change the way authentication is done. (Even if this is improbable in practice) At least FIDO2 firmware has a fixed interface.

Bit warden in that sense is not device-bound but synced.

First, what surprised me is that during the enrollment process, the client is not required to sign a challenge and the server is not required to check it. There's some irony here. Adding this to the flow would be simple layered security, instead of complete reliance on the TLS channel. Something for the Internet Standards people to take into consideration.

Next, passkeys are annoying the way most major websites use them. You can in fact, make a great login experience using passkeys, but not that way capitalone.com Google does (Sorry to pick on you two guys, but it's pretty bad). I won't even mention statefarm.com because their entire website is in a constant state of being javascriptastically broken. Websites treat Passkeys as an accessory, when really it should be the other way around. Passwords, and... sigh, sms, need to be treated as unwelcome accessories.

To make a better user experience:

1: When enrolling a passkey, use the consumers name and permanent business key on your side. Something like `John Doe - PK501867` where PK501867 is an external customer identifier.

2: Lose passwords. Make this a secondary login method on your website, hidden.

3: Don't require SMS "2fA" if they use their passkey. You shouldn't be doing SMS anyway, so stop.

4: Don't use the "well known endpoints" for passkeys or anything related. It's an annoying and confusing consumer experience. Let the user initiate the login. Don't be clever.

5: Instead, just put a button called "Login with Passkey". When they click it, begin the auth flow in the browser. Use async RESTful calls with proper verbs (POST) and correct http signalling. If they authenticate, then redirect. If they don't, update the page but don't cause a navigation.

This by far, keeps the browser 100% functional and follows a natural user experience. It pushes users to use their passkey.