Passkeys might really kill passwords
Today on the flagship podcast of video podcasts:
02:52 - The Verge's David Pierce chats with 1Password's Anna Pobletts about good password hygiene, passkeys, and the upsides of a third-party password manager.
Passkeys: all the news and updates around passwordless sign-on support
Biometrics? Bring it on: why Okta’s Jameeka Green Aaron wants passwords to go away
How to use a passkey to sign in to your Google account
1Password’s passkeys explainer
31:56 - Victoria Song joins the show to discuss the state of wearables and why this may be the year for the smart ring.
Fossil is quitting smartwatches
This might be the year of the smart ring
The best smartwatches for Android
The best fitness trackers to buy right now
58:46 -Later, David answers a question from The Vergecast Hotline.
Apple Vision Pro review: magic, until it’s not
Here’s how much the Vision Pro’s accessories cost
Email us at vergecast@theverge.com or call us at 866-VERGE11, we love hearing from you.
Subscribe to The Verge's YouTube channel for full Vergecast episodes.
Learn more about your ad choices. Visit podcastchoices.com/adchoices
710: A Passwordless Future Passkeys with Anna Pobletts
In this supper club episode of Syntax, Wes and Scott talk with Anna Pobletts of Passage about passkeys, how passkeys work, how to implement passkeys on your website or app, what the recommended UI is for passkeys, what happens to your passkey if you lose your phone, and more.
Show Notes 00:32 Welcome
01:36 Why do we need something like Passkeys?
03:34 What are Passkeys for?
10:04 What took us so long to get to Passkeys?
11:07 Where’s the two factor part of Passkeys?
13:08 How are Passkeys phishing resistant?
14:44 What happens to your Passkey if you lose your phone?
18:40 What’s the password recovery workflow like with Passkeys?
23:08 Having a backup device helps a lot with Passkeys
24:58 Why companies should use two factor or Passkeys
29:26 What are the standards and tech behind Passkeys?
32:38 What kinds of companies are implementing Passkeys?
34:34 What is the recommended UI for telling users about Passkeys?
39:17 How do you implement Passkeys on your app or website?
41:47 1Password open sourced low level libraries
47:34 What does the future look like for Passkeys?
51:07 Supper Club questions
53:44 Sick Picks
1Password
Have I Been Pwned
1Password Watchtower
Passkeys.directory
passkeys.dev
FIDO Alliance - Open Authentication Standards More Secure than Passwords
Sick Picks Cascadia
Shameless Plugs Passage by 1Password
Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads
Wes: X Instagram Tiktok LinkedIn Threads
Scott:X Instagram Tiktok LinkedIn Threads
Passkeys for a passwordless future (Interview)
This week we’re talking about Passkeys with Anna Pobletts, Head of Passwordless, at 1Password. Will Passkeys enable a passwordless future? Time will tell. Anna shares the what, the why, how, and the when on Passkeys.
Join the discussion
Changelog++ members save 9 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Square – Develop on the platform that sellers trust. There is a massive opportunity for developers to support Square sellers by building apps for today’s business needs. Learn more at developer.squareup.com to dive into the docs, APIs, SDKs and to create your Square Developer account — tell them Changelog sent you.
Drata – Put security and compliance on autopilot. Build trust with your customers and scale securely with Drata, the smartest way to achieve continuous framework compliance for SOC 2, ISO 27001, HIPAA, GDPR, and more.
Raycast – Raycast is a blazingly fast, totally extendable launcher. It lets you complete tasks, calculate, share common links, and much more. Turn Pro to harness the power of AI, make Raycast your own with custom themes, keep your Macs in sync and more on the way.
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Featuring:
Anna Pobletts – LinkedIn
Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
Passkeys: the future of authentication in 1Password
Passage by 1Password
Passkeys Overview (Apple Developer)
Supporting Passkeys (Apple Developer)
passkeys.directory
passkeys.dev
Something missing or broken? PRs welcome!
Passage: A Passwordless Service with Biometrics
Passage adds device native biometric authorization to web sites to allow passwordless security on devices with or without Touch ID.
In this episode of The New Stack Makers, Passage Co-Founders Cole Hecht and Anna Pobletts talk about how the service works for developers to offer users its biometric service.
Hecht and Pobletts have worked in product security for many years and the recurring problem is always password-based security. But there really is no great solution, Pobletts said. Multi-factor authentication adds security but the user experience is lacking. Magic links, adaptive MFA, and other techniques add a bit of improvement but are not a great balance of user experience and security.
“Whereas biometrics is the only option we've ever seen that gives you both great security and great user experience right out of the box,” Pobletts.
The goal for Hecht and Pobletts: offer developers what is challenging to implement themselves: a passwordless service with a high security level and a great user experience.
Passage is built on WebAuthn, a Web protocol that allows a developer to connect Web sites with browsers and various devices through the authenticators on those devices, Pobletts said.
“So that could be anything right now,” Pobletts said. “It's things like fingerprint readers and face identification. But in the future, it could be voice identification, or it could be, you know, your presence and things like that like it could be all sorts of stuff in the future. But ultimately, your device is generating a cryptographic key pair and storing the private key in the TPM of your device. The cool thing about this protocol is that your biometric data never leaves your device, it's a huge win for privacy. In that passage, your browser, no one ever actually sees your fingerprint data in any way.”
It’s cryptographically secure under the hood with Passage as the platform on top, Pobletts said.
WebAuthn is designed for single devices, Pobletts said. A developer authenticated one fingerprint, for example, to one device. But that does not work well on the Internet where a user may have a phone, a tablet, and a computer. Passage coordinates and orchestrates between different devices to give an easy experience.
“So in my case, I have an iPhone, I do face ID,” said Hecht showing the service. “And then I'm going to be signed in on both devices automatically. So that's a great way to kind of give every user access to the site no matter what device they're on.”
With Passage, the biometric is added to any device a user adds, Hecht said. Passage handles the multidevice orchestration.
Use cases?
“FinTech people like the security properties of it, they kind of like that cool, shiny user experience that they want to deliver to their end users,” Hecht said. And then any website or business that cares about conversions is kind of a general term. People who want signups, who are trying to measure success by the number of people registering and creating accounts, are signing up. “Passage has a really nice story for that because we cut out so much friction around those conversion points.”