Passkeys only

My company’s product p25.dev uses as its only authentication mechanism Passkeys. I was already asked by two persons why; and if there’s a way for username/password authentication. When it comes to the decision of only supporting Passkeys, product UX and security are worth discussing.

Product UX

I like how simple it is to open an account on p25.dev. Choose a username, create a Passkey, and you are in. No need to provide an email, no extra step of email verification, no waiting.

The same goes for Sign in: Click on the button, choose the Passkey, and you are in.

Thanks to user feedback, it is also possible now to create more than one Passkey, in case you use multiple Authenticators.

Users expect a “Forgot password” feature, which is usually email dependent. For an email gateway product, this can be a frustrating lockout scenario, if the user needs to change an important setting to access their emails again. With Passkeys, we have a recovery flow too (email raphael@p25.dev, and we will sort it out). I don’t expect this to happen often though due to the backup features of modern Passkey authenticators.

Time-based One-time Password (TOTP) 2FA apps proved to me that losing those codes is generally not a problem due to built-in automated backups.

Security

Passkeys exist because they are phishing and man-in-the-middle resistant, a major advantage over username/password/2FA authentication.

Let’s change perspective and think about the typical features of username/password flows:

1. On registration, verify email flow
2. “Forgot password” flow via email
3. “Change E-Mail” flow
4. Enable or require 2FA TOTP based logins (typically including backup codes)

This is a lot of sensitive application surface that entirely falls flat with Passkeys-only. That means in my opinion, Passkeys are not only more secure and easier to use from a user perspective. They also remove a lot of additional work from an application development perspective, especially in this security sensitive area.

Staying Passkeys-only

If you did not use Passkeys before, maybe my points convinced you to prefer them. At least I hope you understood why they make a lot of sense for a product like p25.dev, and why username/password authentication would create more problems than they solve for this product.

As we keep building p25.dev, you can subscribe to our mailing lists p25+subscribe@lists.p25.dev and postern+subscribe@lists.p25.dev to receive announcements about those products and feature updates (send an arbitrary subject/body).

If you wonder what “Postern” is: p25.dev’s open-source companion Mail Delivery Agent with an already powerful Policy Engine at its core. Even though it is in alpha, development is steady and Postern already powers those mailing lists.