Passkeys: The Future of Secure Credential Exchange is Bright

FIDO Alliance Announces Secure Credential Exchange Specifications

Passkeys — the modern, phishing-resistant alternative to passwords — could soon become easier to use across various platforms. According to new draft specifications published by the FIDO (Fast Identity Online) Alliance, companies like Google, Apple, and Microsoft are set to allow users to export and import passkeys securely. This transition will simplify the process of managing credentials, such as migrating from Android to iOS without generating new passkeys for every service.

The New CXP and CXF Draft Specifications

The FIDO Alliance released two draft specifications on Monday — Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF). These are built to enhance user experience while utilizing passkeys. They streamline the secure transfer of credentials, unlike the current method which exposes users to risks by exporting data in plaintext.

• Currently, most password managers export credentials in plaintext.
• The new specifications will improve security during key exchange.
• They allow direct migration of passkeys across services such as Bitwarden to Google accounts.

Samsung's Expansion of Passkey Support

Furthermore, Samsung is rolling out support for passkeys to its TVs and other devices. This innovation shows a commitment towards a future where credential management is both efficient and secure.

Community Feedback on the Specifications

It's important to note that widespread adoption may take time. The new draft specifications require agreement and standardization among credential providers. The FIDO Alliance is currently seeking community review through GitHub, where both developers and enthusiasts can provide feedback.