Authenticate 2026: Day 2 Recap

By: FIDO Staff

There is no shortage of issues for organizations to deal with when it comes to identity and authentication, which makes for a rich and varied lineup at Authenticate 2026.

Day one was loaded with sessions detailing best practices and the road ahead. Day two of the event continued those conversations, extending them with talks that challenged attendees to think differently about issues, including barriers to adoption and AI. As always, there were real world examples of user stories detailing best practices for passkey deployment.

Keynotes: Is Authentication Dead?

The opening keynote started with a controversial premise.

“Authentication is dead, you can’t authenticate your users any harder, any more vigorously, and expect different outcomes,” Ian Glazer, Head of Continuous Identity Product Strategy at Crowdstrike, said.

Glazer’s alternative is to make recognition, rather than repeated ‘prove it’ checks, the digital front door. Systems could continuously build confidence from signals on a user’s device, with privacy-conscious, on-device processing; when recognition falters, a passkey acts as a secure hint to recover access and refresh that baseline.

“Here’s the deal, authentication is dead, but it’s not gone,” Glazer said. “Let’s think of it like the fire escape and let’s stop using it like the front door.”

Keynotes: The Future of Identity Trust Hangs in the Balance 

In his keynote, Derek Hanson, Field CTO at Yubico, argued that identity systems must be designed for a world where AI lowers the cost of attacks and quantum computing may challenge today’s cryptographic foundations. 

Rather than panic over emerging technologies or wait until their impact is clear, he urged organizations to take a measured approach: mitigate risks they can address now, test for likely future changes, and build foundations that can adapt over time. That means treating identity as a core part of security and recognizing that security cannot depend on people always making the right call.

“When we rely on humans, we are fundamentally going to end up in issues where we are the weakest link, and I say that as somebody who has been the weakest link,” Hanson said. “So if we’re going to think this through, we need to start looking at what is AI doing, what is quantum doing, and any new changes, and we need to start to develop a framework.”

Keynotes: Why Passkeys Stall: The People and Process Barriers to Adoption

Passkeys have reached scale. Eve Maler, founder of Venn Factory and author of “Mastering Digital Identity”, noted that there are now 7 billion passkeys worldwide, yet in her Authenticate keynote, she argued that adoption keeps hitting the same edge cases. 

Some apps can’t take a passkey yet. Others are odd cases, like an RFID scanner tied to an SSO-only app. Account recovery is another weak spot. She described one 7,000-person company that had to invent a “passkey holiday,” a temporary one-time-password workaround for employees who get locked out. At another company, the help desk reported to a different group, so the identity team had to “browbeat” agents into performing ad hoc liveness checks they weren’t trained or motivated to do. 

“Technical difficulty used to be an alibi,” Maler said. “The story now is that the hard part has moved into the org chart. It’s not about technology; it’s about people and process.”

Maler’s fix is to run passkeys as a product, not a project. That means having an owner who controls the strategy and the backlog. It also means treating everyone the program touches as a customer: end users, help desk agents, app owners, auditors and fraud analysts. She framed identity’s goals as “Five Ps”: protection, personalization, payment, people and productivity. 

“You’re not just building login boxes, you know that,” she said. “You’re building the reality and the experience of trust.”

Driving Passwordless Forward for 200,000+ Users at General Motors

Some journeys to passwordless are more complicated than others.

Andrew Cameron, Technical Fellow at General Motors, and Nick LewAllen, Senior Identity & Access Management Engineer at GM, detailed how the automaker moved its workforce off a legacy identity stack and toward passwordless. More than 200,000 users relied on an on-prem federation stack built around Microsoft AD FS. That stack also had to serve special cases such as plant workers who can’t carry phones.

The migration was very involved. LewAllen said the team ran 19 waves in total, 8 to move MFA and 11 to move users to cloud authentication. His rule of thumb was to balance speed against impact risk. “Only convert a number of users your support teams can actually handle at once. Repeatability is what turned a scary migration into a routine change,” he said.

“So, what does passwordless actually look like across an enterprise of this size?” LewAllen asked. “One unified login experience and passwordless, phishing-resistant authentication enabled for all of our users,” he said.

Cameron said admins should get device-bound passkeys, while other workers can use options such as Windows Hello on managed devices. He closed with five lessons for anyone planning a similar move.

• Get the data right first.
• Start small and iterate.
• Make waves inclusion-based.
• Communicate before every login change.
• Automate the moving parts.

Tinder Keeps the Bots Out and the Real Users Swiping

A dating app only works if the people on it are real. Tinder’s Sumanth Pinninti and Manish Chhabra said that the job falls to authentication for a platform with about 40 million monthly active users and roughly 5 billion matches a year. Fraud has grown from scammers and bots to AI agents.

Tinder has tried different approaches to reduce risk and adds friction only where the risk is high. The company has relied on SMS codes that cost it millions of dollars and is now testing passkeys as a faster replacement. “We want to double down on passkeys,” Chhabra said.

Whether it’s passkeys or another change, the goal is to leave real users unaffected. 

“What we want to make sure is that the real user is not impacted. It’s a seamless user experience for a good user,” Chhabra said. “For a bad user, we want to make sure they are prevented at the front door, which is authentication.”

Digital Payment Credentials: Beyond Passkeys, Redefining the Checkout Experience

Passkeys handle authentication but how do they fit into payments? That’s a question that Jonathan Grossar, Senior Vice President, Checkout Services at Mastercard, and Prateek Dwivedi, Product Manager at Mastercard, detailed in a morning session about Digital Payment Credentials (DPCs).

“At a very high level, this is a verifiable credential that represents a payment instrument,” Grossar said.

Grossar noted that DPCs complement payment passkeys, which already support authentication, while enabling additional wallet-based payment and identity experiences.

One future use case is agentic commerce with DPCs potentially helping verify that an AI agent’s purchase matches the consumer’s intent. Grossar said that turning that vision into interoperable practice depends on FIDO’s standardization work, including the Payments Working Group’s DPC transaction-context specification, alongside real-world pilots.

Inside the MCP Roadmap: What’s Next for Agentic Identity

As AI is increasingly deployed, enabling authentication is critically important.

AI is able to connect to different resources via the Model Context Protocol (MCP), which itself is steadily advancing its authentication capabilities.

“MCP clients are making calls over the open internet to go and get data, and every call that goes out, you have to answer two questions: Who’s calling me? Are they allowed to do the thing they’re trying to do?,” said Max Gerber, Principal Software Engineer at Twilio. “So MCP didn’t want to reinvent the wheel here, we wanted to reuse OAuth, reuse the OAuth ecosystem and OAuth community.”

To that end he explained that MCP clients are OAuth clients and MCP servers are OAuth resource servers. An MCP client needs to get an access token from the authorization server that the resource server trusts before it can make calls and access protected data.

Den Delimarsky, Technical Staff Member at Anthropic, noted that MCP is continuing to move forward with the integration of standards that support stronger token security, reduce reliance on stored secrets, and give agents their own identities. The key efforts include:

• DPoP (Demonstrating Proof of Possession): Binds an access token to a client-held private key, so a stolen token alone can’t be used by an attacker.
• WIF (Workload Identity Federation): Lets an environment—such as Kubernetes or GitHub Actions—prove its identity and obtain short-lived credentials instead of storing long-lived secrets.
• WAG (Workload Authorization Grant): A proposed standard for agents to identify themselves to services and receive credentials as agents, rather than simply acting as a human user.

Unlocking the Future: Inside Meta’s Passkey Strategy

Meta is going all in on passkeys with its new Meta Account effort. Meta announced the account in April as a single identity behind Facebook, Instagram, Threads and Muse, so one passkey works across all of them. Meta started the work in earnest in January and now has more than 100 million Meta Account passkeys.

“Over the next few months, we expect, and into next year, we expect many, many, many multiples of this, and so we’re right at the beginning of that curve, which is super exciting,” Alistair Thornton, Director, Product Management at Meta, said. “Now, we don’t create passkeys for the sake of having passkeys, obviously, but we’re really excited that all the passkeys created are leading to real value in our ecosystem.”

Jason Cheung, Product Marketing Manager at Meta, described a three-part strategy of enablement, adoption and usage. Enablement meant making passkeys work across all of Meta’s apps, including support for multiple passkeys per user and the Signal API, so a passkey deleted in a Meta app is also deleted from the user’s credential manager. 

Adoption started in the U.S. and Canada before going global. Most passkeys were created right after login or when users opened the Facebook app. For usage, Meta is focusing on high-friction moments such as two-factor authentication and re-authentication, where passkeys make the biggest difference.

“Our general theme that we want to communicate to the industry is like, I think we have to remember that basically outside of this conference, no one wants to know what a passkey is,” Thornton said. “Like that’s our problem. That’s not their problem. What they want is they want to get into the app quicker.”

The Future of Account Recovery

One of the most difficult challenges with strong authentication is the issue of account recovery.

Recovery is critical to the sign-in journey because it’s the fallback path that users take when their default primary sign-in method isn’t available to them.

“Just like passkeys, we want recovery to be very secure and very usable at planet scale. If it’s not, then the value of the passkey itself is diminished,” said Claire Forszt, Product Manager at Google. “If a passkey can be recovered with a lower security bar than the passkey holds, then the security benefits of passkeys essentially sort of become moot.”

One potential option that was outlined by Forszt and her co-presenter, Bill Chen, product manager at Google, is Digital ID. Chen explained in the Digital ID model, credentials from governments, banks, telcos or private identity providers sit in a mobile wallet and follow an issuer–holder–verifier model.

“Digital ID has a lot of potential. It provides phishing-resistant protection that we’d need to uphold the bar of passkeys,” Forszt said. “It provides that guarantee of issuance quality, and it provides a route of trust.”

Get Ready for Day 3

Day 3 will have even more great content across multiple tracks, including regulations, standards, mobile and the new frontier in identity and authentication.

Not registered? Don’t miss out! Attend remotely and access all previous sessions on demand, and attend day 3 live via the remote attendee platform! See the full agenda and register now at authenticatecon.com.