The Passkey Rollout

The story

After episode one, Meridian had rolled out TOTP to everyone with an admin bit, which meant Meridian had rolled out complaints to everyone with an admin bit. Priya Nair, Lakeside’s nurse and unofficial staff ombudsperson, summarized the mood: “You made us do math to look at a calendar.”

Then in October the phishing email arrived — a good one. meridian-health.support-portal.net, a pixel-perfect copy of the login page, “your session has expired, please re-authenticate to view an urgent lab result.” Urgency, authority, a plausible domain. Four staff members clicked within the hour. Two typed their passwords. One got as far as the TOTP prompt and typed that — a real-time relay would have had a valid code with twenty seconds on the clock.

It went nowhere, because three weeks earlier Ana had shipped passkeys, and the people most likely to be targeted had been enrolled first. The lookalike page could imitate every pixel of Meridian’s login except the one thing it needed: the origin. A passkey is scoped to the relying party’s domain; the browser will not even offer Meridian’s credential to support-portal.net. The phishing kit’s operators saw a page that produced no passwords, no codes, and no interest.

The part Ana hadn’t expected was that passkeys were also the popularity win. Face-ID-to-calendar beat password-plus-math by every metric Priya cared about. Enrollment, which she’d budgeted a quarter of nagging for, went voluntary after the phishing story made the rounds. Even the TOTP holdouts converted when the step-up prompts got rarer — with the risk engine scoring context, a physician logging in from the same workstation she used yesterday simply wasn’t asked.

Why this is hard the traditional way

Every shared-secret factor — password, TOTP, SMS — has the same structural flaw: the user is the component that decides where to present the secret, and users can be fooled by a sufficiently good fake. Anti-phishing training lowers the click rate; it cannot make it zero, and an attacker needs one.

WebAuthn fixes the structure — the browser binds the credential to the origin, so the decision the user can get wrong is removed — but implementing it raw is a protocol project: registration and assertion ceremonies, challenge lifecycle, attestation formats, credential storage, and the operational cliff nobody warns you about: the relying-party ID is immutable once users enroll, and changing it orphans every credential in the fleet. Teams that hand-roll it tend to discover that last one in production.

How Sentinel changes the ending

Passkeys are a first-class factor in Sentinel, not an extension point: ceremonies, challenge tracking and credential storage ship in the box, and the configuration surface is small and honest — a relying-party ID the docs tell you to treat as immutable, and an allowed-origins list the docs call what it is: the phishing-resistance anchor of the whole design. Assertions from any other origin fail verification. That sentence is the entire October incident.

The assurance is also legible downstream. A passkey login marks the session’s MFA level as phishing-resistant, minted into the token — so Meridian’s admin routes and prescription endpoints can demand phishing-resistant proof specifically, not just “some second factor, sometime”. And step-up composes with the risk engine instead of with annoyance: deterministic signals decide when to challenge, the challenge is a ceremony with no approve-button to fatigue, and the routine same-desk login stays one gesture. Security that got quieter as it got stronger — which is, Priya conceded, “acceptable”.

What it costs you to ignore this

• One relayed TOTP code is a full session. Real-time phishing kits are commodity software; your training program is racing their copywriters.
• Password + math is a tax on every login, paid by your busiest, most senior staff, hourly, forever. Fatigue is a security cost too — tired users approve things.
• Hand-rolled WebAuthn has a one-way door. Get the RP ID wrong and the fix is re-enrolling every user; get origins wrong and you’ve built phishable phishing-resistance.
• Healthcare credentials are premium inventory. The market that priced Amara’s reused password has a separate, higher tier for a physician’s.