In 1961, MIT's CTSS asked a user for the first password, and within a few years the password file had already leaked. Sixty years on, we are still shipping workarounds for the same bug: one-time codes, federated login, magic links. Climb that ladder rung by rung and a pattern appears: every layer relocates the shared secret (into a device, a provider, an inbox) without ever removing it. And anything with a shared secret can be phished.

Passkeys are the first widely deployed step that deletes the secret instead of moving it. This talk takes them apart from first principles: what a passkey actually is (a key pair, nothing more), why a stolen credential database becomes a list of worthless public keys, why one thumb-press is already multi-factor, and the detail that earns passkeys their reputation: the browser, not the human, decides whether a login page is genuine, which is what finally kills phishing by design.

Then we make it concrete. The two WebAuthn ceremonies, registration and authentication, reduce to one pleasingly symmetrical round-trip: a challenge out, a signature back. We'll build a live passwordless, usernameless login with the browser's native API and no JavaScript dependencies, and finish with the parts tutorials skip: account recovery, the second-passkey problem, bootstrapping the first account, and where the email address really fits (a label, not a credential).

You'll leave knowing exactly what happens when your thumb touches the sensor, and with a working recipe for shipping passkeys in your own app.

This talk is backed by a two-part written series on my blog ("Passkeys from first principles" and "Building passkeys in Ruby on Rails from scratch") and by passkeyed, an open-source Ruby gem I published that packages the approach.

Structure:
1. The bug report: MIT, 1961, the oldest open ticket in software.
2. Sixty years of workarounds: the authentication ladder of 2FA, federated identity and magic links, and why each one relocates the secret rather than removing it.
3. What a passkey actually is, and the two consequences: worthless breach dumps, single-gesture MFA.
4. Why phishing dies: the RP ID check moves site verification from the human to the browser.
5. The two ceremonies plus a live demo: passwordless, usernameless sign-in built with the native browser API.
6. The honest parts: recovery, the second-passkey problem, account bootstrap.

The core talk is framework-agnostic (the ceremonies are pure WebAuthn); the demo can be shown in Ruby on Rails or as plain HTTP endpoints depending on the audience. All diagrams and code are my own. I have spoken at iOSCon, DroidCon, dotSwift, DevTalks, and numerous other developer events and webinars; recordings are on my speaking page.