Passkeys Substack

Payday Super turns your SMS bill into $1.38m

Vincent Delitz — Fri, 31 Jul 2026 15:09:06 GMT

Here are this week’s topics that you don’t wanna miss out on!

💸 Payday Super: How SMS OTP costs explode in 2026

🏦 MFA Update to Malaysian Central Bank Risk Management

Payday Super turns your SMS bill into $1.38m

From 1 July 2026 Australian employers have to pay super with every payroll run, which turns a member who logged in 4 times a year into one who logs in 24 times or more. At 5 cents per SMS OTP that stops being a rounding error. A fund with 1 million members goes from roughly 230,000 dollars a year to 1,380,000. Funds carrying 2 to 4 million members land between 4 and 6 million, and two more deadlines hit the same window, SuperStream 3.0 and the ACMA Sender ID Register, so the SMS channel gets pricier and more regulated at once.

The security argument for keeping it is gone too: SS7 is unencrypted and exploitable through SIM swapping or reverse-proxy phishing, and AustralianSuper’s credential stuffing incident cost members 750,000 dollars out of just 10 accounts.

UniSuper, 130 billion dollars under management, already shipped passkeys and pays nothing per login after the first enrollment. The post breaks down per-provider SMS pricing and a three-phase enrollment plan that clears 80 percent adoption in a few quarters, which raises the uncomfortable question: if your login volume is about to sixfold, who is signing off on the per-message budget?

Malaysia’s regulator just retired SMS OTP

Bank Negara Malaysia’s November 2025 RMiT update quietly changed the verb. Guidance about stronger authentication became a binding requirement for every licensed bank, insurer, e-money issuer, payment operator and remittance institution in the country.

They now have to run MFA that is “more secure than unencrypted SMS” and “resistant to interception or manipulation”, which reads as an exit notice for the SMS second factor. The policy also defaults to one mobile device per account holder with an explicit opt-in for more and it wants the authentication code tied to the confirmed beneficiary and the amount, so transaction signing arrives without being called that.

Malaysian banks blocked over 383 million Ringgit of fraudulent transactions in 2024, so nobody is theorizing here. The post puts the five changes next to the old baseline and shows why passkeys cover the phishing-resistance, passwordless and device-binding clauses in a single move. Singapore, Australia and India are drifting the same way, so which regulator forces your hand first?

Next week I am speaking at the FIDO Alliance India workshop

The FIDO Alliance India Working Group Meetup and Workshop runs on Friday 7 August, 9:00 to 16:00 IST, at Google Ananta in Bengaluru. I am on the agenda with a “Passkeys explained” session, alongside Nishant Kaushik on the FIDO technical roadmap, Lee Campbell, Niharika Arora and Eiji Kitamura from Google on Android and Chrome, SETS on Aadhaar and passwordless, plus adoption stories from PhonePe, MakeMyTrip and Visa. Given the two posts above, India is exactly the market where the SMS OTP question gets decided at scale next.

Two regulators, one question: what does your login flow actually do?

Payday Super and RMiT push you to the same place, an authentication flow you are about to rebuild without SMS sitting in the middle of it. Corbado Observe splits that flow into its subflows and shows what happens inside each one, which step users clear, which one they quietly abandon and where the fallback keeps getting triggered. Watch a real flow get taken apart in the video below.

Inspect every subflow

Join the Passkeys Community!

Our mission is to free the world from passwords to make the Internet a safer place - this can only be accomplished together.
Join our passkeys community to connect with other passkey enthusiasts, stay up-to-date, get implementation support and show your passkeys projects!

Join Passkeys Community

The best CIAM won't fix your 5% passkey adoption

Vincent Delitz — Fri, 24 Jul 2026 15:54:53 GMT

Here are this week’s topics that you don’t wanna miss out on!

📊 Best CIAM Solutions 2026: Passwordless & AI Compared

📱 Native App Passkey Errors: Ultimate Overview (2026)

Compare all 12 platforms

Picking the best CIAM won’t get you past 5% passkeys

We compared 12 CIAM platforms at 500k monthly active users, from Auth0 and Ping Identity down to Firebase and Supabase and the monthly bill swings from roughly 599 dollars to 30,000. But the number that should worry you is a different one: passkey adoption stalls at 5 to 10 percent on almost every platform, no matter how modern the login screen looks.

The post calls this the orchestration gap, the space between an API that technically supports passkeys and a flow that actually gets people to use them. A settings-only setup converts under 1 percent of logins to passkeys while a device-aware flow with identifier-first recovery clears 60 percent.

There is also a new column most buyers miss: whether the platform can hand an identity to an AI agent over the Model Context Protocol. And the real cost is not the license, it is the 25 to 30 FTE-months a custom passkey build burns before you even reach maintenance. So if your shortlist only weighs price and feature checkboxes, what is it quietly missing?

Android passkeys fail 3-5x more than iOS. Here is why

On the web a failed passkey is one generic DOMException. In a native app you finally see the real platform error codes, iOS ASAuthorizationError values and Android’s 50xxx Google Play Services messages, but you also inherit a far messier problem.

Eight things vary at once, OS version, app version, device brand, model, authenticator state and more, and Android’s median abort rate runs 10 to 14 percent against just 2 to 3 percent on iOS. The gap is fragmentation: flagship phones fail 3 to 15 percent of the time while budget devices can fail 75 to 90 percent, which is why a single universal alert threshold is useless. A 5 percent abort rate means something is broken on iOS but is a perfectly normal success rate on a cheap Android.

The tells to watch for are authentication loops, three or more failures within minutes on the same device, and silent device avoidance, users who quietly switch to the browser after the app fails them. Would your logs tell those two stories apart?

Two posts, one blind spot: the login you cannot see

The CIAM you buy and the Android build you cannot control fail for the same reason: nobody is watching the passkey flow while it happens. Corbado Observe shows every enrollment and login as it runs, which users succeed, which ones abort and exactly which device and error code killed the attempt. Get the full picture in the overview below.

Stop flying blind

Join the Passkeys Community!

Join Passkeys Community

Why hardware security keys lose users before the first tap

Vincent Delitz — Sat, 18 Jul 2026 08:19:16 GMT

Here are this week’s topics that you don’t wanna miss out on!

🔑 Hardware Passkey Observability: Close the UX Gap

🤖 Android & Google Play Services Passkey Error Codes (2026)

See the security key UX gap

The most secure passkey is the one users rarely pick

Hardware security keys are the most secure form of passkeys, the only kind that reaches NIST’s highest assurance level AAL3.

Yet in financial services their adoption often stays in single digits months after launch. The reason is not security, it is the operating systems: iOS, Android and Windows all push their own synced passkeys first and bury the hardware key behind menus like “Other sign-in options”.

One mandatory rollout at a Japanese securities firm went so badly that customers paid local IT shops 7,700 yen just to get logged in.

This post shows how observability closes that gap: funnel data reveals where people give up, session replays show what a failed NFC tap actually looked like and device telemetry exposes toxic combinations like Android 14 builds that break third-party providers entirely. If 60 percent of your iOS users abandon before even finding the key option, would you know?

Android has 50+ passkey error codes. Your app sees 12

Google Play Services keeps more than 50 internal passkey error codes and your app only ever sees 12 generic WebAuthn errors.

This guide maps the whole 50100 to 50196 range and explains which codes actually matter in production. The big one is 50162: a synced passkey exists but the device cannot decrypt its private key, so retrying is pointless and you need a fallback.

There is also a quiet Chrome regression where a formatting change in Play Services turned duplicate-credential errors into a meaningless UnknownError. It gets trickier because Android routes passkey calls through two different paths, legacy FIDO2 or the newer Credential Manager, which report the same failure in different formats.

The same phone can even use one path for creating a passkey and the other for signing in. So when a login dies on some Samsung out there, would your logs tell you why?

Both stories end the same way: you cannot fix what you cannot see

A cryptic 50162 in a log and a security key nobody uses are the same problem wearing different clothes: something broke in your login flow and no one saw it happen.

Corbado Observe tracks every passkey enrollment as it happens, so you see which users create passkeys, which ones fail and exactly where they give up. Watch it work on a real funnel in the video below.

Track enrollment live

Join the Passkeys Community!

Join Passkeys Community

Why Apple passkey error 1004 tells you nothing

Vincent Delitz — Fri, 10 Jul 2026 11:57:00 GMT

Here are this week’s topics that you don’t wanna miss out on!

🍎 Apple Passkey Error Codes: Complete Reference (2026)

🧩 WebAuthn vs. CTAP vs. FIDO2: Key Differences

Decode Apple's error codes

What Apple’s error 1004 is actually trying to tell you

Apple passkey failures used to be a guessing game. For years almost everything bubbled up as a single generic code, 1004, which tells you a login broke but not why.

This guide maps Apple’s full error pipeline across iOS 26.2 and macOS 26.2, from the private ASCAuthorizationError numbers to the public codes your app actually sees. It shows how Apple has slowly pulled real signals out of that catch-all: 1005 when no credentials exist, 1006 for a duplicate, 1010 when the device has no passcode or iCloud Keychain.

There is even a twist the docs do not mention, where the detail you need shows up in a field nobody thinks to check. So the next time a passkey silently fails on iPhone, will you know if it is a user cancel, a config problem or a real bug?

WebAuthn, CTAP, FIDO2: which one do you actually code against?

WebAuthn, CTAP, FIDO2, passkey: four words for what feels like the same thing, and almost everyone mixes them up. This post draws the clean lines.

FIDO2 is the umbrella.

WebAuthn is the API you actually write code against, in the browser or a native app.

CTAP is the binary protocol that only kicks in when you talk to a roaming key over USB, NFC or Bluetooth, which means platform authenticators like Face ID skip it entirely.

The practical punchline: over 95 percent of passkey deployments never touch CTAP directly, and the common belief that hand-rolling CTAP gives you a nicer native experience is backwards. So are you about to build something the operating system already does for you?

You know the spec. Do you know what users actually pick?

You can memorize every Apple error code and draw the FIDO2 diagram from memory and still have no idea what your real users are doing at the login screen. Are they actually creating passkeys or quietly falling back to passwords every time? Corbado Observe shows the real passkey versus password split in your own funnel, so the theory finally meets what people do.

See what users actually pick

Join the Passkeys Community!

Join Passkeys Community

The £1.17bn reason the UK backs passkeys

Vincent Delitz — Fri, 03 Jul 2026 07:32:52 GMT

Here are this week’s topics that you don’t wanna miss out on!

🇬🇧 Passkeys UK: An Overview [2026]

🔐 WebAuthn credProtect: Security Keys

See the UK breakdown

Inside the UK’s £1.17 billion passkey wake-up call

The UK just hit a tipping point on passkeys and the numbers explain why. Fraud losses reached £1.17 billion in 2024 across 3.13 million incidents and the NCSC is now openly telling people to drop passwords for phishing-resistant logins.

Government is pushing this at citizen scale too: GOV.UK One Login already covers more than 13 million users across 120+ services and NHS Login treats passkeys as a first-class option not an afterthought.

Banks are split, with neobanks like Revolut going full password replacement while the incumbents move in careful stages. The post maps 12 live UK deployments from British Airways to EE to HMRC and pulls out the one thing that keeps tripping teams up.

Spoiler: it is not the passkey itself, it is what happens when someone loses their device. So what separates the rollouts that stick from the ones that quietly fall back to passwords?

Why your security key works in Chrome but dies in Safari

Here is a bug that will drive you slowly insane. You register a security key in Chrome, everything looks fine, then the exact same key silently fails in Safari for no obvious reason.

The culprit is credProtect, a WebAuthn extension that controls when a credential can be used without user verification. When you use discoverable credentials with userVerification set to “preferred”, Chrome quietly bumps the protection to Level 3 without telling anyone and Safari cannot complete the PIN negotiation that Level 3 needs.

Google hits this on their own login: keys registered without a PIN get downgraded and pushed back to a password. The post breaks down exactly which settings trigger the escalation, why Firefox handles it differently and the two options that make keys behave the same everywhere. So is your “preferred” setting quietly locking users out of one of their browsers?

Both stories come down to one user you can’t see

The UK rollouts that stall die at recovery, and the credProtect bug fails one browser for one user at a time. In both cases the login just quietly breaks and support has no idea why. Corbado Observe lets you pull up any single passkey user and replay exactly what their authenticator did, step by step.

Debug any passkey user

Join the Passkeys Community!

Join Passkeys Community

Why bank passkeys stall below 1% adoption

Vincent Delitz — Fri, 26 Jun 2026 11:43:04 GMT

Here are this week’s topics that you don’t wanna miss out on!

🏦 10 Passkey Deployment Mistakes Banks make

📱 Native Passkey Challenges: iOS & Android Pitfalls

See the 10 mistakes

Most rollouts fail where you can’t see

Both stories end in the same blind spot. The bank stuck below 1% and the native app losing users after install both fail somewhere in the funnel and neither team can see exactly where: which subflow stalls, which device drops off, why a passkey login quietly errors out. Finding those drop-offs is precisely what we built Corbado Observe for.

See where users drop off

10 mistakes that keep bank passkeys stuck below 1%

Most banks treat shipping passkeys as an infrastructure project: switch it on in the IdP, announce it, done. The article makes the uncomfortable case that this exact mindset is why so many rollouts stall under 1% adoption while product-led teams push past 50%.

It walks through 10 concrete mistakes, from splitting credentials across subdomains with the wrong rpID, to burying passkeys deep in account settings where nobody finds them, to identifier-first flows that quietly leak which customer emails exist.

The scariest ones are about lockout and fraud: letting an attacker with a stolen password enroll their own passkey, or stripping passwords before any real recovery path exists. There are also compliance traps, since some regulators still do not count synced passkeys as a real possession factor.

Each mistake comes with what to do instead, pulled from real banking rollouts in Japan and beyond. So which of these 10 is silently capping your own numbers?

Native passkeys take 3 to 6 months not two weeks

Plenty of teams budget two weeks for native passkeys and then lose three to six months to platform quirks nobody warned them about. The post is a field guide to those traps on iOS and Android.

On Apple, the AASA domain file fails silently with the wrong Team ID, Apple’s CDN caches it with no purge button, then about 5% of users hit errors right after install because iOS has not verified the domain yet.

On Android there are three different signing keys and only the Play Store one works in production, plus no wildcard support and a maze of OEM behavior from Samsung Pass to Huawei without Google services.

Then come the subtle bugs: Base64 versus Base64URL silently corrupting credentials, WebView origin mismatches plus simulators that fake biometrics so your tests pass while real devices fail. It closes with the actual fixes, down to the exact Play Services version that stops a nasty multi-account crash. So which of these would have blown up your two-week estimate first?

Join the Passkeys Community!

Join Passkeys Community

The passkey problems nobody warns you about

Vincent Delitz — Fri, 12 Jun 2026 15:51:36 GMT

Here are this week’s topics that you don’t wanna miss out on!

🐛 Passkey Day 2 Problems: 5 Risks after Launch

🍎 How to delete a Passkey from a YubiKey?

See what breaks after launch

Your passkey demo works. Now comes day 2.

Building passkeys is the easy part. Operating them in production is where projects stall. The article lays out five “Day 2” risks that surface after launch:

Recovery & fallback done badly forces a choice between locking users out and reintroducing phishing
Cross-ecosystem fragmentation across Apple, Google, and Microsoft (iCloud Keychain won’t sync to Windows/Android; QR cross-device login breaks under MDM)
Native app complexity that roughly triples your QA surface
Adoption as a product problem, where technically sound rollouts still hit <5% adoption (healthy = >60% creation, >40% login)
Silent platform regressions, like the iOS 26.2 bug that broke isUserVerifyingPlatformAuthenticatorAvailable() in non-Safari browsers.

Bottom line: the WebAuthn server is simple. The infrastructure that survives thousands of device/OS combinations is not.

“Not enough space”: freeing up your YubiKey

A practical fix for the “not enough space” error during passkey enrollment. Your YubiKey’s discoverable-credential storage is full (up to 100 slots on newer keys, 25 on older ones). Because discoverable credentials live on the hardware, you reclaim space by listing and deleting individual passkeys via the ykman CLI (ykman fido credentials list / delete) or the Yubico Authenticator GUI, both requiring your FIDO2 PIN. A full ykman fido reset wipes all FIDO credentials and the PIN irreversibly, so it’s the last resort.

Join the Passkeys Community!

Join Passkeys Community

From 5% to 90%: passkey adoption playbook at Identiverse 2026

Vincent Delitz — Fri, 05 Jun 2026 07:34:01 GMT

See my Identiverse talk

📍 I’m speaking at Identiverse 2026 (Las Vegas, June 16, 2pm PDT). This post provides a high-level summary and why you should come by if you’re around.

There are two camps in the passkey world.

Camp A ships passkeys, ticks the box and lands at a ~4% passkey login rate six months later (Corbado Passkey Benchmark 2026).
Camp B treats adoption as the actual project and reaches 40-70% login rate, with 70 to 90% of mobile users activated.

The difference has almost nothing to do with the technical WebAuthn integration and everything to do with what happens after the code goes live.

Shipping code is day zero

The day your passkey code goes live is day zero. Adoption is not a side effect of a good implementation. It is its own project with its own roadmap, owner and metrics. (more on what breaks after launch).

5 phases for highest passkey adoption

Integration and testing: flows that hold up across every OS, browser, and authenticator combo. Harden the build, then scale. (Native app passkeys)
Gradual rollout: step by step, OS by OS, with observability from day one. Riskless approach with fallbacks.
Adoption engineering: A/B-test copy and UI prompts, enable identifier-first and one-tap login flows. Engineer adoption into every click. (Conditional create)
Omni-channel: passkey-first on every channel. Mirror web flow and re-use existing passkeys in native apps.
Enforce and mandate: passkeys by default, passwords by exception. Push stronger prompts, announce a timeline for retiring passwords.

What the playbook helps you achieve

40 to 70% passkey login rate
70 to 90% mobile passkey activation
4 to 6× faster sign-ins
40 to 70% fewer password and MFA resets
95% fewer login errors (with passkey intelligence)

At the scale of a 5-million-user base, that is a different operating model and not a rounding error (see full case study: VicRoads passkey launch)

Seeing adoption is half the battle: Corbado Observe

Every number above only moves if you can see what happens after launch: which subflows convert, where users drop off,

why a passkey login fails. That visibility is exactly what we built Corbado Observe for. Here’s the 3-minute overview:

Check out our Youtube Video

Catch the live version at Identiverse 2026

I’ll walk through the full playbook with more insights on stage:

🗓 Tuesday, June 16, 2:00-2:25 PM, PDT

📍 Mandalay Bay F, Las Vegas

Reach out to meet at Identiverse

If you are running a passkey rollout or about to start one, come by or grab me afterward. I’d like to hear which phase you’re in and where you might be stuck.

95% of WebAuthn errors are not errors

Vincent Delitz — Mon, 01 Jun 2026 14:19:27 GMT

Here are this week’s topics that you don’t wanna miss out on!

🐛 Ultimate WebAuthn Errors in Production Guide (2026)

🍎 isUVPAA iOS 26.2 Bug: Fixed in iOS 26.3 stable

Decode WebAuthn Erros

Why most WebAuthn errors are not bugs

Most teams treat every WebAuthn error like a system failure, but the numbers say otherwise. In optimized production deployments, over 95% of recorded errors are actually expected user aborts: someone hit cancel, clicked away or let the prompt time out.

The post sorts the noise into 8 real DOMException types (NotAllowedError, AbortError, SecurityError and the rest) and shows how to classify them by operation type, timing and platform instead of just the error name.

It also surfaces the messier edges: password manager extensions like Bitwarden or 1Password intercepting WebAuthn calls and returning broken credential objects, iOS 18’s new error code 1006 for duplicate credentials, and Windows 11 passkey completion sliding to 45 to 60% on identifier-first flows.

The right error taxonomy turns your auth logs from a wall of alarms into real signal. So which of your “errors” are actually customers who just changed their mind?

iOS 26.2 broke passkey detection in WKWebView

Apple shipped a regression in iOS 26.2 that made isUserVerifyingPlatformAuthenticatorAvailable() return false inside WKWebView, so Chrome, Edge and Firefox on iPhone all stopped detecting passkeys even on devices that fully support them.

The fix landed in iOS 26.3 stable (build 23D127), but the gap leaves a real chunk of users stranded on broken versions for weeks. The post walks through the older isUVPAA() boolean and the newer getClientCapabilities() dictionary, and shows when each one lies.

Surprisingly, getClientCapabilities() is the more reliable signal on iOS 26.2+ non-Safari browsers, but flips wrong inside Google App’s webview where it reports passkeys work and they do not. There is a platform-aware fallback chain to keep your detection honest while iPhones drift across versions. So which API should you actually trust right now to decide whether to show the passkey button?

Join the Passkeys Community!

Join Passkeys Community

Why 2FA no longer stops modern phishing

Vincent Delitz — Fri, 15 May 2026 08:48:08 GMT

Here are this week’s topics that you don’t wanna miss out on!

🎣 Phishing-as-a-Service explained: AI, Deepfakes & Defense

🛒 E-commerce Funnel Analysis: Why Amazon & Shopify win

See how PhaaS works

Phishing is now a subscription business

Phishing used to take real skill, but not anymore. There is a whole underground market where anyone can rent a ready-made phishing kit, complete with customer support and regular updates, for about the price of a streaming subscription.

One tool called Tycoon 2FA runs 89% of that market and it does something nasty: it sits between you and the real login page, grabs your session cookie and walks right past your two-factor code.

AI made the problem worse. Hoxhunt found that AI-written spear phishing went from clearly weaker than top human scammers in 2023 to beating them by early 2025.

The average phishing breach now costs companies 4.88 million dollars. So what actually stops an attack that copies the real login page perfectly?

Why checkout on Amazon feels like magic

When you buy on Amazon you do not really check out, you click once and the thing shows up at your door.

Every other shop makes you stop and decide: guest or account, PayPal or card, type your details again or hunt for a password. Each of those little choices quietly costs sales: forced account creation alone drives 24% of cart abandonment.

Express checkout options like Apple Pay and Shop Pay convert 20 to 40% better because they skip the typing entirely. The biggest leak is the login wall, which hits around 85% of shoppers and loses 35 to 60% of them right there.

The article breaks down how Amazon and Shopify measure the parts of the funnel everyone else ignores. So which metric are most teams missing while they chase tiny tweaks?

Join the Passkeys Community!

Join Passkeys Community

World Passkey Day: Passkey Benchmark 2026 is live

Vincent Delitz — Thu, 07 May 2026 07:52:46 GMT

Today is World Passkey Day 2026. We’re using it to publish two things teams have been asking us for:

A benchmark to compare their passkey rollout against
A way to run those numbers on their own data

Open the Passkey Benchmark 2026

It combines production data with qualitative interviews from 100 identity leaders.

It’s one of the most detailed passkey adoption datasets and it’s now public.

The core idea: passkey adoption is multiplicative

Passkey adoption is not one number. We define it as Readiness × Creation × Usage

Most passkey rollouts plateau because one layer is silently dragging the product down and nobody can point to which one.

Layer 1: Readiness

97–99% market readiness, mobile: If you’re not seeing this, your eligibility logic likely has a bug.
97–100% WebAuthn capabilities: Nearly universal. Lower numbers usually mean your browser-targeting rules are too conservative.

Layer 2: Creation

Up to 83% enrollment rate: Below 50%? Your prompt timing or UI is losing users.
Up to 62% Conditional Create uplift: Free conversion if you support it. Zero if you don’t.
97% Top-4 provider share: These four shape portability, autofill, and sync.

Layer 3: Usage

Up to 90% authentication success: Below 70%? Check your implementation.
60–86% cross-device authentication range: Cross-device authentication UX is where many rollouts leak.
94% Conditional UI completion: Add it or you’re leaving conversion on the table.

Answer “how’s the rollout going?” with production numbers, not guesses.

Benchmarking your own rollout used to mean five tools and a custom integration. So we built one.

Process mining for authentication: see the real path users take

Corbado Observe is the first auth-native observability layer: a drop-in JavaScript SDK plus a single console.

Compare login methods: passkey vs password. Success rate, time-to-complete.

Three situations Observe solves

“Success rate dropped 8 points last Tuesday.”
Find exactly where the funnel leaks: Identifier entry, decision point, prompt, ceremony, completion. Then cohort by browser, OS or provider.
“Are passkeys actually faster than passwords for us?”
Compare passkeys, passwords and other login methods side by side: Conversion, time-to-complete, success rate.
“A user escalates: I can’t log in.”
See the full authentication history for one user across web and native.

Why not your IDP? Why not Mixpanel?

Your IDP runs authentication. It does not observe it. Mixpanel and Datadog see clicks and logs. Corbado Observe understands WebAuthn ceremonies, recovery flows, provider fragmentation and passkey-specific drop-offs.

Create a free Console Account

Cyber Voices podcast on Passkeys

I joined Igor Gjorgjioski from VicRoads on Cyber Voices, AISA Australia’s official podcast, for Navigating the Passkey Revolution.

It became one of the show’s highest-rated and most-downloaded episodes. Listen on Apple Podcasts or Spotify

Join the Passkeys Community!

Join Passkeys Community

Deploying Entra ID passkeys without breaking MFA

Vincent Delitz — Fri, 01 May 2026 07:16:27 GMT

Here are this week’s topics that you don’t wanna miss out on!

🪪 Enterprise Passkey Deployment Challenges & Solutions

🇻🇳 Vietnam Banks race to Passkeys after $744M Fraud Crisis [2026]

Read the full breakdown

The Entra ID passkey traps nobody warns you about

The technology side of passkeys is basically solved. The painful part is rolling them out across thousands of employees in Microsoft Entra ID without breaking sign-in for anyone.

One wrong toggle on attestation and every iCloud or 1Password passkey gets blocked. Forget Bluetooth on a corporate laptop and the QR-code flow silently dies. New hires hit the chicken-and-egg problem of needing a passkey to register their first passkey, which is exactly what the Temporary Access Pass is built to fix.

The piece walks through the config mistakes, the BYOD recovery costs nobody budgets for and the hybrid model that keeps both auditors and your help desk happy. So which of those traps is your tenant already sitting on?

Vietnam just deactivated 86 million bank accounts

Vietnam lost a staggering $744 million to online fraud in 2024 and the central bank decided enough was enough. New rules now force biometric checks on any mobile transfer above roughly €375 and 86 million accounts got frozen in September 2025 for missing the verification deadline.

Big names like Vietcombank, Techcombank and ACB went live with face scans almost overnight. The problem is that biometrics on their own keep getting fooled. A money laundering ring busted in May 2025 used deepfaked face scans to drain real accounts.

That is exactly why FIDO2 passkeys are now showing up as the missing layer that binds a login to a single device. Will Vietnam’s banks add passkeys before the next deepfake hits or keep paying for the next billion-dollar lesson?

Join the Passkeys Community!

Join Passkeys Community

Workforce passkeys: enrollment is where rollouts die

Vincent Delitz — Sat, 25 Apr 2026 13:03:20 GMT

Here are this week’s topics that you don’t wanna miss out on!

💼 Workforce Passkeys: Deployment Guide for IT Teams

🇯🇵 Passkeys Japan: An Overview [2026]

Read before your rollout stalls

Workforce passkeys: the hard part is not the technology

Passkeys for employees sound simple: replace passwords with phishing-resistant login and make SSO safer. In reality, the biggest challenge is usually not WebAuthn itself. It is enrollment, recovery, device policy and explaining to employees what is actually happening. The article breaks down how workforce passkeys work with systems like Entra, Okta and Ping and why device-bound passkeys are often the safest default for managed corporate devices. It also covers the messy parts teams hit in production, from synced vs device-bound decisions to Windows Hello confusion, WebViews, contractors, shared devices and lost hardware. Read more to see the practical rollout playbook that keeps passkeys from becoming just another IT support headache.

Passkeys in Japan: what happens when regulation meets real-world rollout

Japan has become one of the most interesting passkey markets to watch. After a sharp rise in phishing and account takeover attacks, financial regulators pushed banks and securities firms to move fast on phishing-resistant MFA. The result: more than 50 passkey providers are now live or planned, with players like Rakuten Securities, Nomura, SBI, Monex and Mizuho moving from pilots to serious rollout.

The article shows why Japan is not just another passkey success story though. Android fragmentation, Windows and Edge usage, corporate networks and cross-device QR flows create very real rollout problems.

Read more to see what Japan teaches every enterprise team before they remove passwords for good.

Join the Passkeys Community!

Join Passkeys Community

Authentication success rate: the metrics that matter

Vincent Delitz — Fri, 17 Apr 2026 12:51:18 GMT

Here are this week’s topics that you don’t wanna miss out on!

🔑 Authentication Analytics: Metrics & Login Funnels

🏛️ Login Friction kills Conversion: 5 Symptoms & Fixes

Show me the Metrics that matter

The authentication analytics playbook

Most teams still treat login like a black box. You see who got in and who did not, but not where people dropped off or why. This article lays out what authentication analytics actually means and which metrics matter most, from login success rate and drop-off rate to passkey enrollment and usage. It also shows why product teams security teams and identity teams often look at the same login flow and come away with totally different conclusions.

One of the most interesting parts is how modern passkey flows break normal funnel tracking and force teams to work backwards from the result.

Read more to see which events data sources and dashboards you really need if you want to understand authentication instead of guessing

Login friction kills conversion

A lot of conversion problems are really login problems in disguise. This article breaks down five classic signs of login friction, like users dropping off at sign-in, too many password resets, flaky SMS codes, mobile login pain and security measures that quietly annoy legit users. It explains what to measure for each symptom and why the damage is bigger than it looks, especially at checkout when intent is highest.

A strong point in the piece is that most analytics tools only show the bounce, not the failed password attempts late OTP or confusing login choice that caused it. The takeaway is simple: every extra step acts like a tax on user intent and some of the most expensive leaks in the funnel happen right at login.

Read more to see which symptoms are likely hurting your numbers already and what to fix first

Join the Passkeys Community!

Join Passkeys Community

Silent Passkey Upgrades: the +30% Activation Trick

Vincent Delitz — Fri, 10 Apr 2026 15:54:11 GMT

Here are this week’s topics that you don’t wanna miss out on!

🔑 Conditional Create for Passkeys: Support & Effectiveness

🏛️ NYDFS Part 500 MFA requirements 2025 (New)

Unlock +30% Passkey Activation

Conditional passkey creation explained

Most teams think passkeys are all about login. This article shows why creation is just as important and how conditional UI changes the game. Instead of forcing users through a separate signup step you can trigger passkey creation right in the flow when it makes sense. That means higher activation and less friction from day one. It breaks down how browsers handle conditional create and what you need to implement it correctly across devices.

You also get a clear view on current limitations and where things still break in real deployments. The big question is how much adoption lift you can unlock just by changing when you ask users to create a passkey.

NYDFS MFA rules 2025 what really changes

New York is tightening the rules on MFA and passkeys are suddenly front and center. This piece walks through the updated NYDFS Part 500 requirements and what they actually mean for real systems. It explains why phishing resistant MFA is no longer optional and how regulators define it in practice.

You will see where traditional OTP and SMS setups fall short and what needs to change to stay compliant. It also covers rollout challenges for large consumer platforms that cannot just flip a switch overnight. The interesting part is how this will push passkey adoption faster than expected across financial services.

Join the Passkeys Community!

Join Passkeys Community

FedCM explained and why browser login is changing

Vincent Delitz — Fri, 03 Apr 2026 09:45:24 GMT

Here are this week’s topics that you don’t wanna miss out on!

🌐 FedCM (Federated Credential Management API) Overview

💬 Telegram Passkeys: End of OTP Authentication

See how FedCM changes login

FedCM explained how browsers want to fix federated login

Federated login has been around for years yet it still feels messy and risky in many cases. This article breaks down how FedCM aims to change that by moving identity flows into the browser instead of relying on redirects and third party cookies.

You get a clearer user experience more privacy and less tracking across sites. It also explains what actually changes for developers and why this matters for big identity providers like Google. If you care about the future of login flows this is one of those shifts you should understand early. The big question is whether this will finally fix the trust issues around federated login and how it plays with passkeys.

Telegram passkeys what it means for messaging and beyond

Telegram rolling out passkeys is a big signal that passwordless is moving into everyday apps not just security products (like it used to be when it was framed as WebAuthn for 2FA).

The article walks through how Telegram integrates passkeys into their login flow and what that means for user experience across devices. It highlights where things feel seamless and where there are still rough edges especially with cross device usage.

You also get a sense of how large scale consumer apps think about adoption and rollout. This is about where authentication is heading next. The open question is how far this approach can scale and what others will copy from it.

Join the Passkeys Community!

Join Passkeys Community

How DBSC counter stolen cookies that bypass passkeys

Vincent Delitz — Fri, 27 Mar 2026 12:48:21 GMT

Here are this week’s topics that you don’t wanna miss out on!

🍪 Device Bound Session Credentials (DBSC) explained

🔐Atlassian Passkeys for Jira, Confluence, Bitbucket & Trello

Get the full DBSC Breakdown

Device-Bound Session Credentials (DBSC) explained

This article looks at the security gap that starts after login. Passkeys stop phishing at sign-in, but they do not stop attackers from stealing a live session cookie and reusing it somewhere else. That is where Device Bound Session Credentials come in. The post explains how DBSC ties a session to a key stored on the user’s device, so a stolen cookie becomes much less useful to an attacker trying to hijack an account from another machine.

The article also does a good job showing why this topic matters now. It walks through how infostealer malware steals browser cookies, how those logs get sold, and how attackers can use them to bypass MFA without ever touching the original login flow.

At the same time, it keeps things practical: DBSC is not magic, it does not fully stop malware on the same device and browser support is still early, with Chrome running an origin trial and other browsers not yet fully on board. Read more to see how DBSC works with passkeys and why this combination could become the next big step in account protection.

Atlassian passkeys are here

Atlassian has rolled out passkey support across Jira, Confluence, Bitbucket and Trello. The article explains why that matters far beyond a nicer login screen. Passkeys are phishing-resistant because they are tied to the real domain, so fake login pages and typo domains simply do not get the credential prompt. It also shows how each Atlassian product benefits in its own way, from protecting Jira admin access and Confluence knowledge bases to securing Bitbucket developer accounts and reducing risk in Trello’s more loosely managed team setups.

What makes the piece useful is that it does not stay abstract. It gets into real rollout questions like when to use hardware-backed passkeys for high-risk Bitbucket admins and how Atlassian Guard policies can help enterprises push adoption, audit login methods and bring shadow IT accounts back under control through domain verification.

It also links passkeys to fewer password resets, faster sign-ins, and fewer support tickets, which is exactly the kind of angle security and IT teams care about. Read more to see where passkeys fit best inside the Atlassian stack and what a smart rollout could look like.

Join the Passkeys Community!

Join Passkeys Community

How pension & retirement funds can implement passkeys

Vincent Delitz — Fri, 20 Mar 2026 11:22:57 GMT

Here are this week’s topics that you don’t wanna miss out on!

🏦 How Super Funds can implement Passkeys

🆔 Apple Digital ID: Add your U.S. Passport to Apple Wallet

See the 4-Phase Plan

How super funds can roll out passkeys without breaking everything

After the 2025 attacks on Australian super funds, one thing became pretty clear: passwords are still the weakest link.

This piece looks at why passkeys are such a strong fit for super funds in particular, from stopping credential stuffing to cutting SMS and support costs. It also gets into the real-world challenges, like older member demographics, legacy systems and strict compliance requirements.

What makes the article useful is that it does not stop at the why. It walks through a phased rollout path, from adding passkeys first to driving adoption and eventually going fully passwordless.

The big question is what happens when you want better security without turning your whole identity stack upside down. Read more to see what that rollout can actually look like

Apple Digital ID is bigger than just putting your passport on your phone

This article explains what Apple Digital ID actually is and why it matters now that U.S. passport holders can add their passport to Apple Wallet. It breaks down the difference between Apple’s feature, state mDLs and the mDoc standard behind it all, without making it feel overly technical.

You also get the practical part: who can use it today, how setup works and where it is accepted right now. The more interesting angle is that this is not just about travel convenience. It shows how digital ID shifts identity checks away from showing a plastic document and toward cryptographic proof on a device.

That opens up a much bigger story around privacy, verification and what digital identity could become next. Read more to see why this move could change the pace of digital ID adoption.

Join the Passkeys Community!

Join Passkeys Community

Device-bound passkey adoption & observability

Vincent Delitz — Fri, 13 Mar 2026 10:45:42 GMT

Here are this week’s topics that you don’t wanna miss out on!

🔑 Hardware Passkey Observability: Close the UX Gap

🤳 WebAuthn Transports: Internal and Hybrid Transport

Increase device-bound passkey adoption

Device-bound passkeys are secure but adoption is struggling

Device-bound / hardware passkeys like security keys or smart cards are often seen as the gold standard of authentication. The private key never leaves the device which makes them extremely resistant to any kind of credential attacks.

Yet in real B2C deployments many companies notice a pattern: people register a device-bound passkey once and then rarely use it again. Synced passkeys from Apple, Google or stored in 3rd-party password managers simply feel easier in daily use.

The result is that organizations invest in strong security for their customers but cannot prove the adoption or business impact. This article breaks down why that happens and why authentication observability is the missing piece to understand real login behavior and drop-offs.

Read more to see how companies can finally measure whether hardware passkeys actually work in the real world.

Internal vs. hybrid WebAuthn transports explained

When a passkey login works across devices there is a hidden mechanism behind it: WebAuthn transports. These transports decide how an authenticator communicates with a device.

“Internal” usually means the passkey lives on the device itself like Face ID or Windows Hello.
“Hybrid” allows cross-device authentication where you scan a QR code and approve the login on another device via Bluetooth.

Sounds simple in theory but the reality is messy because browsers iOS and Android all implement these transports slightly differently. That leads to confusing edge cases and unexpected behavior in production systems.

Read more to understand how internal and hybrid transports actually work and which implementation approach developers should choose.

Join the Passkeys Community!

Join Passkeys Community

4 Steps to passwordless authentication with passkeys

Vincent Delitz — Fri, 06 Mar 2026 10:55:47 GMT

Here are this week’s topics that you don’t wanna miss out on!

❌ How to go fully passwordless

📈 Passkey Adoption at Authenticate 2025: 6 Case Studies

Go passwordless!

How to go fully passwordless

Many teams think enabling passkeys means they are already passwordless. In reality that’s only step one. This article breaks down the full journey to removing passwords completely and explains why most implementations get stuck halfway. It walks through a four-phase path from integrating passkeys to driving real user adoption and finally removing passwords safely.

A key challenge is recovery: if users lose their devices the fallback flow often brings passwords back through the backdoor. The article explains how modern recovery flows can stay phishing-resistant while keeping the user experience smooth.

If you want to understand what it really takes to eliminate passwords in large consumer systems you’ll want to see the full framework. Read more to see the four phases and why most passwordless projects fail before the final step.

Passkey adoption lessons from Authenticate 2025

At Authenticate 2025 several large platforms shared how they rolled out passkeys to millions of users. The stories from companies like eBay, Uber, TikTok, Roblox and DocuSign reveal a clear pattern: adoption does not happen automatically. Some companies rely on smart login prompts and metadata to nudge users toward passkeys while others redesign the entire sign-in flow around them.

The case studies show what actually moves the needle on adoption such as passkey-first sign ups or integrating passkeys into everyday login journeys. They also reveal surprising metrics and UX tricks that helped these platforms scale passkeys across very different audiences. If you are curious what works in real deployments and what doesn’t these examples are worth a look. Read more to see the six real case studies and the tactics behind their adoption numbers.

Log into Windows with a Bitwarden passkey

Join the Passkeys Community!

Join Passkeys Community