This article from Meta Engineering details a novel system design for enabling cross-device passkey authentication on devices lacking traditional displays, such as XR headsets, IoT devices, and smart home hubs. It outlines an architecture that bypasses QR codes by leveraging a companion mobile application and existing FIDO CTAP hybrid protocols to securely transfer authentication requests and facilitate user verification, thereby extending passwordless security to a wider ecosystem.
Read original on Meta EngineeringThe article addresses a significant challenge in modern authentication: how to implement secure, phishing-resistant passkeys on devices without accessible displays. Traditional cross-device passkey flows rely heavily on QR codes for establishing a secure link between a relying party (e.g., a desktop) and a mobile authenticator. This method becomes impossible for devices like Meta Quest, smart home hubs, or industrial sensors. Meta's solution adapts the WebAuthn passkey flow and FIDO's CTAP hybrid protocol to overcome this display limitation.
Standard cross-device passkey flows use QR code scanning and Bluetooth/NFC proximity. While proximity is feasible for discovery, confirming user intent without visual feedback on the inaccessible device poses security and usability risks. Users need clear assurance that they are approving the correct transaction on the correct device. This problem necessitates a secure message transport mechanism that can replace the QR code's role in conveying the authentication request payload and routing information.
Meta's architecture leverages an existing companion application (e.g., Meta Horizon app) that shares the same authenticated account as the inaccessible device. This companion app acts as a secure intermediary to transport the FIDO URL payload, which traditionally would be embedded in a QR code. The system uses authenticated push channels for reliable and secure delivery of this payload to the mobile authenticator.
Design Principle: Leveraging Existing Infrastructure
This design effectively reuses existing infrastructure (companion apps, push notification services, and FIDO standards) to solve a new problem. This minimizes development effort and leverages established security boundaries, rather than inventing entirely new communication channels.
This innovative approach maintains the robust security of existing passkey frameworks while significantly enhancing usability for devices where a display is either absent or inaccessible. It demonstrates how core authentication protocols can be adapted for a burgeoning ecosystem of IoT, XR, and other screenless devices, pushing passwordless authentication beyond traditional desktop and mobile environments.