Passkeys promise a cleaner future: no shared secrets, less phishing, and fewer humans being blamed for typing passwords into the wrong box. But what happens when you build the authenticator yourself?

In this session, we’ll take a cheap microcontroller, some open-source firmware, and turn it into a working FIDO2 authenticator capable of storing and using passkeys. Then, instead of congratulating ourselves, we’ll start asking uncomfortable questions.

What exactly are we trusting? What assurance do we have over the hardware and its supply chain? Where are credentials actually stored? If someone gets physical access to the device, can they dump its storage, recover private key material, modify the firmware, or clone a credential onto another device? And what changes when we start enabling hardware security controls such as secure boot, protected storage and debug restrictions?

Along the way, we’ll pull apart concepts such as user presence, credential protection, hardware-bound keys and device trust, using a real authenticator rather than an architecture diagram.
The result is less a guide to building your own security key and more a live risk assessment of one: a practical look at the gap between “it implements FIDO2” and “I trust it with my identity.”