Passkeys: should I add them to my app's login?
posée a month ago659 vuesen
Passkeys seem to be everywhere now (Google, GitHub, banks). Is it worth implementing them for my app, and how hard is it?
Diagnostic IA
Généré par IA. Ce n'est pas une réponse — la communauté ci-dessous le confirme ou le corrige. Vérifiez toujours avant de vous y fier.
1 réponse
For most apps with user accounts, yes. Passkeys (WebAuthn/FIDO2) are phishing-resistant: the credential is bound to your domain, so a fake login page can't use it. There's no password to reuse, leak or brute-force, and login is faster (fingerprint or face unlock).
How it works: the device creates a key pair and your server stores only the public key. At login, the device signs a server challenge with the private key, which never leaves the device (it's synced via iCloud Keychain or Google Password Manager).
Implementation: - Don't hand-roll WebAuthn. Use SimpleWebAuthn (JS/TS), py_webauthn, webauthn4j, or your auth provider's built-in support (Auth.js, Clerk, Auth0, Supabase…). - Offer passkeys alongside existing login at first ("Add a passkey" in settings, then offer it after password login). - Keep a solid account recovery path (email plus a second factor). Recovery is where passkey rollouts are usually weakest.
Support is broad across modern iOS, Android, Windows and macOS, but keep a fallback for users on older devices.
Connectez-vous pour dire si ça a marché.
Sign in and verify your email to post an answer.