Embracing passwordless authentication with Grab’s Passkey

Summary

Grab’s Passkey adds passwordless authentication to its app to address phishing, keystroke-logging, brute-force, and other security threats associated with passwords plus the friction of OTP-based login. Built on the FIDO standard and implemented through WebAuthn, the flow uses a backend, frontend, and authenticator: the authenticator creates and stores a passkey, while Grab stores the public key and metadata. Registration uses a server-generated challenge and parameters including rp.id, user information, resident-key requirements, and supported public-key algorithms; sign-in returns a credential whose signature is verified against the stored public key. Google Password Manager and iCloud Keychain can sync passkeys across supported devices, and users authenticate with their screen lock rather than entering a password or waiting for an OTP. The implementation is described as faster, smoother, phishing-resistant login with potential savings on third-party authentication and messaging costs, while Grab plans to evaluate web login expansion through adoption, feedback, and usage data.

Takeaways

1. 1

   Passkeys keep secrets within the user’s authenticator rather than storing them in Grab’s database; Grab stores the public key and related metadata for future verification.

2. 2

   Passkey registration uses WebAuthn parameters such as a server-generated challenge, rp.id, user identifiers, resident-key requirements, and excludeCredentials to help prevent duplicate device registration.

3. 3

   During authentication, the backend looks up the credential ID and verifies the returned signature against the stored public key; rp.id must match the value used during registration.