Identity Lab
Members

Protocol practice · Authentication & Credentials

Passkeys: register a passkey, then sign in with it

Objective: Lumen Notes is replacing passwords with passkeys. Register one for Rui, sign them in with it, and see why a perfect copy of your sign-in page gets an attacker nothing.

About 12 minutes · simulated, no real servers
  1. 1Start registration
  2. 2Save the passkey
  3. 3Sign in
  4. 4Check the signature
  5. 5Meet the lookalike
Where passkeys fit
Sign-inWho is this?
OpenID Connectbuilt on OAuthSAMLenterprise single sign-onKerberosWindows domains
AccessWhat may this app do?
OAuthaccess for an app
AccountsDoes the account exist?
SCIMjoiners, movers, leavers
ProofHow did they prove it?
PasskeysYou are here
Not sure? Which protocol?

Passkeys at work, every day

Each of these signs someone in with a fingerprint, face or PIN, and no password.

  • Signing in to a shopping site with your faceThe phone checks it’s you; the site checks a signature.
  • A work sign-in with a security keyA device-bound passkey, for staff who need the strongest proof.
  • A phishing email that gets nothingThe passkey won’t answer for a lookalike domain.

Step 1 of 5

Start registration: the options you send

Rui is signed in and taps “Create a passkey”. Your server sends the browser the options for navigator.credentials.create().

navigator.credentials.create({ publicKey: {
  rp:         { id: ______, name: "Lumen Notes" },
  user:       { id: <random handle>, name: "rui@harbor.example" },
  challenge:  ______,
  pubKeyCredParams: [{ type: "public-key", alg: -7 }]   // ES256
} })

Fill in the two blanks, then send the options.

rp.id: the site the passkey will belong to
challenge: what the new passkey signs
Pick an answer for each blank to continue.