NEW YORK — What happened
In September 2026, the FIDO Alliance and major platform vendors finalized an updated cross-platform passkey migration standard. Users switching between different mobile operating systems can now transfer their end-to-end encrypted passkeys locally using direct hardware-to-hardware attestation, bypassing proprietary vendor cloud sync locking.
Why it matters
Passkeys were intended to replace vulnerable text passwords with cryptographic key pairs tied to device biometrics. However, early implementations trapped user credentials inside platform-specific clouds (like Apple Keychain or Google Password Manager). Standardizing direct, encrypted key transfer makes platform switching simpler while keeping private keys isolated from web-based interception.
Deep dive
The protocol relies on direct localized connections, such as encrypted Wi-Fi Direct combined with Near Field Communication (NFC) proximity verification. When transferring passkeys, both devices establish a temporary secure tunnel brokered by their hardware Secure Enclaves (isolated security microprocessors). The private keys are re-encrypted in transit using ephemeral keys generated on the receiving device's physical chip, ensuring that unencrypted credentials never exist in system RAM or over local wireless traffic.
Report check
Claims: Passkey transfers happen entirely offline with zero intermediary servers or cloud logging. Verified: Packet capture analyses during migration procedures confirm that no external server traffic occurs during the key exchange process. Still rumor: Reports that legacy hardware back to 2022 will support these hardware-level attestation transfers remain unverified, as older secure elements lack the required cryptographic primitives.
Open questions
Will corporate IT departments enable cross-platform hardware transfers for managed enterprise accounts, or will administrative locks restrict key migration?