Passkeys explained: how they work and how to roll them out
How passkeys work under WebAuthn, the difference between synced and device-bound passkeys, and a rollout plan that covers fallback and recovery from day one.
Tag
Passkeys
3 posts
Account recovery without account takeover
Recovery is the weakest door into most accounts. Design rules for a recovery email that helps a locked-out person without handing an attacker a second way in.
Step-up authentication: a stronger factor only when it matters
Step-up authentication asks for a stronger or fresher factor only before sensitive actions. Which actions to cover, how fresh a session must be, and how to avoid MFA fatigue.