Passst

Passst is a fictional passwordless authentication protocol described here to illustrate how such systems might be designed. It is not a real standard and has no official specification or deployment.

Overview: Passst replaces passwords with cryptographic credentials anchored to user devices. During registration, a service stores a public key and a credential identifier while the user’s device creates a private key and stores it in a secure element or trusted execution environment. Authentication consists of the device proving possession of the private key by signing a server-issued challenge. The server verifies the signature with the stored public key.

Architecture and flow: Passst envisions optional identity federation, where an identity provider can assert user attributes without exposing password data. It emphasizes device binding and phishing resistance, using roaming tokens or recoverable credentials to recover access on new devices. It supports standard cryptographic algorithms such as ECDSA or Ed25519 and interoperates with extensions similar to WebAuthn, though as a fictional model it is not part of the official WebAuthn specification.

Development and reception: Conceptualized by a community group in the early 2020s, Passst has been studied in academic papers and demonstrations. Proponents argue it reduces phishing and credential theft; critics point to device loss, recovery, and cross-platform interoperability challenges. Because it is fictional, no production deployments or regulatory approvals exist.

See also: Passwordless authentication, WebAuthn, FIDO2, Public-key cryptography.