Tender Surrender

Lately, I have been seeing complaints that passkeys are hard to use. I have also observed several posts from people who were in trouble because they couldn't sign in to a service they wanted to use, simply because the passkey they were sure they had created could not be found.

So in this blog post, I'd like to explore why this happens, how to avoid such situations, what actions users can take, and what service providers can do to reduce the number of users who feel this way.

2023 was indisputably the "Year of the Passkey." An immense number of services added support for passkeys, and 2024 looks set to finally be the year passkeys achieve widespread adoption.

In this article, after reviewing the basics of passkeys, I will address some common misconceptions people often have about them.

Passkeys are a new authentication method that is resistant to phishing and easy to use even for non-tech-savvy users, and they are widely expected to replace passwords eventually. In this article, I'll summarize the basics of passkeys and what they mean for the future of the web.

This is a long article, so let's start with the conclusion.

SharedArrayBuffer and high-resolution timers are now available in Chrome, Firefox, and Safari. To use them, you need to enable a state called cross-origin isolation by sending the following two headers with the parent HTML document:

Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin

However, enabling this comes with various conditions and constraints, and most sites will struggle with it at this stage. If your goal for now is simply to keep things running in Chrome as they have been, registering for a Deprecation Trial and taking a wait-and-see approach might be the safest bet.

This is a long article, so I'll start with the conclusion.

With the arrival of Spectre, the security requirements for websites have increased. Specifically, the following measures are needed:

• Use the Cross-Origin-Resource-Policy header on all resources to control their loading into cross-origin documents.
• Add the X-Frame-Options header or the Content-Security-Policy (CSP) header's frame-ancestors directive to HTML documents to control iframe embedding into cross-origin pages.
• Add the Cross-Origin-Opener-Policy header to HTML documents to control communication with cross-origin pages when opened as popup windows.
• Add appropriate Content-Type headers and X-Content-Type-Options: nosniff headers to all resources to prevent malicious loading from cross-origin contexts.