Companies rely solely on Passkeys for authentication. Issues and breaking changes within the Passkey ecosystem can prevent users from signing in. We kindly request all contributors of the Passkey ecosystem to be mindful of your responsibilities and act carefully.
Readit Newstreesgrowslow commented on Fragile Passkey Ecosystem for Enterprises denniskniep.github.io/pos... · Posted by u/treesgrowslow
We developed FIDO MFA via Standard Browser for applications without WebAuthn Support.
Only if we enforce FIDO-only MFA and block legacy authentication via SMS, Call and Authenticator App we are truly phishing-resistant.
WebAuthn is a requirement, but not always available. Some legacy Apps use WebViews without Webauthn support.
Detached FIDO Authentication is the answer.
We are looking forward to your feedback and hopefully improvement ideas.
A colleague summarized our latest Passkey issues showing the ecosystem remains fragile for enterprises:
Fragile Passkey Ecosystem for Enterprises https://news.ycombinator.com/item?id=39742107