Passkeys and Privacy

This is part 2 of our series on passkeys. See part 1 here.

In our previous article we described what a passkey is: a few hundred bytes of data stored in your password manager, security key, or elsewhere, which allows you to log in to a specific website without a password. The good news is that passkeys are quite well designed from a privacy point of view, even though they give a little more information to websites than a plain old password.

Cross-site Tracking

One of the most important attributes for passkeys is that they shouldn’t enable cross-site tracking. In other words, if you create a passkey on site A, and create a different passkey on site B using a different name, email address, and IP address, the two sites shouldn’t be able
[…]