Most sign-in systems are built around a password and then, years later, patched with something safer. The lab’s identity server, ids, was built the other way around. This note is about why.
Passwords fail the same way every time
People reuse them. Attackers guess them, phish them, or buy them from the last breach. Every defence we add (rules about symbols, forced rotation, security questions) makes the person’s day a little worse, and still leaves the same hole.
A password is a secret that has to be typed into a page. The page can be a fake. That is the whole problem.
What a passkey changes
A passkey is a key pair. The private half never leaves the person’s device, and the browser will only use it for the real site it was made for. Touch the sensor, look at the camera, and you are in.
- There is no secret to leak from your database
- A fake page gets nothing, because the key refuses to work there
- There is nothing for a person to forget
The safest password is the one nobody ever has to create.
Why “first” matters
If passkeys are an add-on, the password stays underneath as the weak door everyone can still walk through. When passkeys are the front door, the password path can be small, optional, or gone, and the whole product leans toward the safe way.
That is the choice behind ids: passkeys first, with multi-factor and consent screens available when you want them.
What it costs
Honest answer: some friction at the edges. People switch devices, lose phones, and share computers. A good system needs a calm recovery path, and recovery is where most of the real design work lives. Passkeys make the common case safe; they do not make the hard cases disappear.
Where to start
Pick one internal tool and put passkey sign-in in front of it. Notice how little there is to explain to the people using it. That is the feeling worth chasing.