Introduction 

During Cybersecurity Awareness Month, Uber is rolling out support for seamless authentication with passkeys on our mobile apps and websites. Use your passkey instead of your password next time you sign in to Uber. 

Passkeys are a simpler and more secure alternative to legacy authentication methods like passwords. When a user registers a passkey with a mobile app or website, their device generates a unique cryptographic key pair associated with their account. The public key is stored on the application server, and the private key is stored on their device’s password manager. Next time the user signs into their account, the device needs to be unlocked with a biometric sensor (such as a fingerprint or facial recognition), PIN, or pattern to authorize the passkey.

The primary benefit of passkeys is that they are more resistant to credential stuffing and phishing attacks. 

Uber is dedicated to enhancing account security and providing frictionless authentication across all of your devices. Passkeys pave the way toward a passwordless future.

How Do Passkeys Work?

The main entities involved in passkey flows are an authenticator and a relying party. For our purposes, an authenticator refers to a user’s device (e.g., mobile phone, laptop, tablet, etc.) which is responsible for generating cryptographic key pairs, securely managing private keys, and verifying the user. A relying party is an application with a client and server. 

The WebAuthn specification, which defines how authenticators and relying parties interact with each other, is standardized across all platforms, so the system architecture is consistent between mobile and desktop devices. As a result, clients can implement cross-device authentication: a passkey created on one device (e.g., an Android device) can be used by another device (e.g., a Windows desktop computer) to authenticate the user. 

In the next section, we review passkey registration and authentication flows to understand what data is stored and shared by each entity. 

Register a Passkey

To register a new passkey, sign in to Uber with the mobile app or website. Navigate to your Uber Account settings and choose to create a passkey. 

Let us break down what is happening behind the scenes of the registration flow.  

Sign in with a Passkey 

Next time you wish to sign in to Uber with your device, you may see an autofill prompt to use your passkey. Otherwise, click the passkey icon next to the form input to initiate login. 

Authentication works similarly to registration, but the data shared between entities is different. 

It is important to note that authenticators never share private keys or user authorization data with the relying party. Furthermore, if the public key stored on the relying party’s servers are compromised, the passkey itself is not compromised, since the private key is stored on the authenticator. 

Delete a Passkey

At Uber, users are in control of their data, so you can view and delete your passkeys from your Uber account settings anytime. When you delete a passkey from your account, this action only removes the public key from Uber’s servers. Your private key still exists on your device, so you need to delete the passkey from your device’s password manager as well. This is similar to the idea that when you update your password, you also need to update the password in your device’s password manager. But do not worry if you forget to delete the private key from your device–the cryptographic key pair is unusable if both keys are not available.

Challenges

Last year, Apple, Google, and Microsoft announced a joint effort to expand their support of passkeys on their platforms. Passkey adoption has accelerated since then, but the learning curve to understand passkeys for developers and users alike has been the main challenge of supporting passkeys at Uber. 

One of the reasons behind this is that browser and device adoption of passkeys is not yet standardized across the board. Depending on the combination of browser and operating system, device capabilities will vary. The large number of potential use cases to support passkeys greatly increases the technical complexity. This caveat is also confusing for users if some of their devices do not support passkeys. In the future when passkeys are more broadly supported across platforms, there will be fewer edge cases to account for.  

Furthermore, we have found it is necessary to develop elegant solutions to help our users bridge the knowledge gap about passkeys. Since passkey adoption is not as widely supported as passwords, users may not understand what passkeys are and thus, they are less inclined to engage with passkey flows. For now, users can fallback to other authentication factors. We anticipate that multiple iterations will be required to perfect the passkey onboarding flow. 

As more of our users adopt passkeys, we intend to leverage data about their pain points to improve the experience authenticating with passkeys.

The Future of Authentication is Passkeys

Passkeys offer a simpler and more secure login experience–yet, we have observed that adoption is currently low among users during the initial rollout. Our roadmap to improve the user experience will be based on analysis of the initial data so that we can pinpoint where our users are struggling. For example, the registration flow is buried in the Uber account settings, so we are experimenting with a post-authentication feature to nudge users to create a passkey after they sign in. This feature aims to improve the registration success rate and make the onboarding process more accessible. 

Uber is committed to building magical user experiences for passkey authentication and excited to help pave the way toward a passwordless future.