Passkey Deployments Are Failing in the Wild. Here's How to Vet One.
New research presented at the 35th USENIX Security Symposium found widespread implementation failures across 103 live passkey deployments. This report breaks down what the researchers found, shows how our own phishing-resistant, cryptographic Passkeys+ deployment measured up against the same criteria, and gives you a framework to vet any vendor's claims, including ours.
Get the Full Report
Don't take our word for it.
0 of 103
Independent university researchers tested 103 live passkey deployments across the web. None passed every security check.
Zero
high or critical findings when the same tests were run against Ideem's deployment. 39 of 42 checks passed.
What You'll Get in This Report
Independent researchers evaluated 103 live passkey deployments and found that real-world implementations often fall short of what the technology promises. We took their published evaluation criteria and applied them to our own deployment. This report gives you both sides: the research and the receipts.
The research, decoded.
A plain-language walkthrough of the evaluation criteria the USENIX team applied to 103 live deployments, and the failure patterns they uncovered.
Our complete results.
How Ideem's Passkeys+ deployment, built on MPC-based device binding, performed against that same bar, check by check, including what we found and what we're addressing.
A vetting framework you can use.
The questions and checks to run against any passkey deployment before you commit, whether you build in-house or buy. Use it on us first.
If you're evaluating passkeys for banking, payments, or fraud prevention, this report gives you the criteria to judge any implementation on the merits, not the marketing.