- Passkeys are critical for phishing resistance, similar to how memory safety addresses memory corruption.
- Server-side implementation of passkeys can be complex, but interoperable passkey record encodings can simplify this.
- The proposed passkey record format is $webauthn$v=1$transports=<type>$<base64 authenticator data>, reusing existing WebAuthn encodings.
- Applications only need to store passkey records per user, similar to managing passwords, with the library handling verification.
- The Go API draft uses RelyingParty methods for registration (NewRegistration, Register) and login (NewLogin, Login) flows.
- Applications manage opaque user IDs, store passkey records, and cache request challenges, while the library handles JSON parsing.
- The proposed model avoids credential ID collision attacks by not using a credential ID index, relying on user ID lookup instead.