Which Passkey Should Your Users Get? FIDO Alliance CTO Explains

Summary

The episode examines how organizations should choose and deploy passkeys, emphasizing phishing resistance rather than simply replacing passwords. Nishant Kaushik explains that the FIDO Alliance’s work grew from the goal of making cryptographic authentication practical and easy for ordinary users, without requiring them to manage cryptographic keys themselves. Its standards evolved through UAF and U2F into FIDO2, which includes WebAuthn—implemented by browsers and maintained at the W3C—and CTAP, which supports communication with authenticators.

Three workforce passkey options

Kaushik distinguishes three broad approaches:

• Synced passkeys: Stored in a credential manager and synchronized across devices. They offer convenient backup and recovery but rely on the credential manager’s security and lifecycle controls.
• Device-bound passkeys in a workforce credential manager: Software-based credentials tied to a device and managed for workforce use. Examples include Microsoft Authenticator and Okta Verify. They can give an organization more control without requiring every user to carry a separate hardware key.
• Hardware security keys: Device-bound credentials whose private keys remain on the physical key. They can offer a more isolated, hardened option, but losing one creates a recovery and replacement challenge.

No single option is automatically right for every user. Organizations should match the authentication method to their user population, risks, and use case, and plan for onboarding, monitoring, recovery, revocation, and deprovisioning.

Security and user experience

Passkeys are designed to resist phishing. By contrast, adding more individually phishable factors does not necessarily produce strong security; it may simply give attackers more ways to trick users. Kaushik recommends evaluating the strength and suitability of an authentication method rather than assuming that stacking factors makes an account secure.

The discussion also cautions against making security so inconvenient that users work around it. Real user behavior—including the use of family devices, device sharing, and how people store information—should inform deployment decisions.

The host says Microsoft’s passkey rollout had enrolled many users, sometimes surprising administrators who had not opted out. He presents it as a way to move users away from SMS-based authentication with less effort than a manual, organization-wide setup. He also mentions Microsoft’s planned SMS and voice MFA phase-out in February of the following year.

Guidance for hardware-key deployments

For organizations considering hardware keys, especially for administrators, Kaushik recommends:

• Choose certified hardware keys.
• Verify a person’s identity when registering and assigning a key. Strong technology is not enough if the organization cannot confirm who received it.
• Decide in advance whether users can register backup keys and what recovery methods will be permitted.
• Establish procedures for lost, compromised, or replacement keys.
• Treat deployment as a managed lifecycle, not a one-time purchase.

Kaushik says that, at the time of the discussion, PQC-ready hardware keys were not yet generally available. He suggests using current deployments to build the operational processes needed to manage future replacements or upgrades.

Post-quantum cryptography

The episode connects passkey planning to post-quantum cryptography (PQC). Kaushik notes that some mandates call for readiness by the end of 2030 and argues that organizations should begin planning now rather than waiting for new products or a specific transition date. Passkeys are a useful step because passwords and other phishing-prone methods cannot simply be made “PQC-proof.” He compares preparation to Y2K: the transition can be manageable if planning and processes happen in advance.

Guides, reviews, and resources

• No product review or step-by-step tutorial is presented.
• The interview provides practical deployment guidance on selecting passkey types, setting up hardware-key operations, and planning for recovery and future upgrades.
• Kaushik mentions the FIDO Alliance’s annual Passkey Index as a source of adoption data and further information.

Main speakers and sources

• Merill Fernando — host of Entra Chat
• Nishant Kaushik — CTO of the FIDO Alliance and guest expert