Authentication experts know the challenge: User logins need to be secure, but also usable. With too much friction, users leave. Without security, users get hacked.
I’m exploring the solution for a long time and represented Vodafone in an industry dialogue by Bitkom and the German Federal Office for Information Security (BSI). In several workshops, we worked on shaping the future of customer authentication. The result will be a publication with clear steps for companies to balance strong security with good user experience.
This week, I shared some insights on stage at it-sa – Home of IT Security. We discussed Passkeys: How can we roll them out so that users experience them as a support and not as a blocker?
The takeaway:
- Start small! No large projects. Embed Passkeys in a small use case for testing.
- Plan this use case fully. Ensure that every step from login to recovery is intuitive and clear.
- Deploy, but slowly. Let a small fraction of your users test your passkey solution. Then get feedback, and refine the user journey before scaling up.
Why is this important? Because user trust is in the details, as we know from related research. Only when account recovery feels simple and secure, Passkeys may potentially become a trusted and accepted support.
Thanks to Bitkom for the invitation, Steffen Waurick, Felix Kuhlenkamp, and Frank-Michael Kamm (D+G) for the great conversation, and all the colleagues in Vodafone for their support in making this possible.
What are your experiences with Passkeys? Did you find them intuitive or do you see room for improving the user journey? Looking forward to discuss this in the comments.