Loading post…
UberExplainer
Use Passkeys Wherever You Sign in to Uber
Summary
Uber rolled out passkey authentication across mobile apps and websites, allowing users to sign in without passwords. Passkeys use a device-generated public-private key pair: the server stores the public key, while the device’s password manager protects the private key and requires biometric, PIN, or pattern authorization. Registration sends creation options and a challenge to the authenticator, which returns an attestation for server validation; sign-in similarly returns a signed assertion that the server verifies with the stored public key. This design keeps private keys and user authorization data on the authenticator, improving resistance to phishing, credential stuffing, brute force, and replay attacks. Uber reported low initial adoption and noted inconsistent browser and device support, user education needs, and technical complexity; it plans to use adoption data and post-authentication prompts to improve onboarding.
Context
Uber introduced passkey support during Cybersecurity Awareness Month as part of its effort to provide passwordless authentication across mobile and desktop experiences. The initial rollout revealed low adoption and differences in passkey support across browsers and operating systems.
Approach / What changed
The implementation follows WebAuthn. During registration, the client requests credential-creation options and a unique challenge, the authenticator generates and stores a private key, and Uber stores the returned public key after validating the attestation. During authentication, the authenticator signs a server-provided challenge, and the server verifies that assertion with the account’s stored public key. Users can manage passkeys in Uber account settings, while fallback authentication remains available.
Takeaways
Passkeys keep the private key on the user’s authenticator and store only the public key on Uber’s server, so compromising the server does not reveal the private key.
WebAuthn challenges help prevent replay attacks, while application-bound passkeys reduce phishing risk by limiting where a device can use them.
Deleting a passkey from Uber removes only the server-side public key; the corresponding private key must also be removed from the device’s password manager, although it is unusable without both keys.
FAQ
Can a passkey created on one device be used on another device?
Yes. WebAuthn is standardized across platforms, enabling cross-device authentication; for example, a passkey created on Android can authenticate a user on a Windows desktop.
What happens if the public key stored by Uber is compromised?
The passkey itself is not compromised because the private key remains on the authenticator. Authenticators also do not share private keys or user authorization data with the relying party.
What are the main adoption challenges for passkeys at Uber?
Browser and operating-system support varies, creating technical edge cases and inconsistent device capabilities. Uber also identified a user knowledge gap and low initial adoption, and plans to improve onboarding with experiments and adoption data.
Source and freshness
- Source
- uber.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.