Topic starter
12/07/2026 12:20 pm
TL;DR: Singpass’s 2026 passkey rollout uses device-bound WebAuthn keys inside the app, not synced cloud wallets, which changes credential control, recovery, and phishing resistance for a national identity system used in 4.5 million monthly app users and 41 million monthly transactions, according to Authsignal. The governance lesson is that sync convenience weakens accountability when the issuer needs revocation, locality, and tighter control over the credential lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “Why Singpass built its own passkey manager instead of using iCloud Keychain”.
Key questions
Q: Should organisations use synced or device-bound passkeys for privileged access?
A: For privileged access, device-bound passkeys are the better default because they keep the private key on a single device and narrow the portability of the credential.
Q: Why do synced passkeys create governance problems for corporate accounts?
A: Synced passkeys can escape the organisation’s control when they land in a personal cloud account that IT cannot inspect or revoke.
Q: What breaks when a passkey model assumes automatic cross-device recovery?
A: Recovery becomes a hidden trust dependency on the sync account and its ecosystem, which can undermine issuer revocation and complicate device loss handling.
Practitioner guidance
- Assess credential custody assumptions Review whether your current passkey policy assumes cross-device recovery, cloud sync, or issuer-controlled re-enrolment, then map that assumption to your risk appetite and help-desk model.
- Separate phishing resistance from recovery design Document which controls make the login phishing-resistant and which controls govern device loss, replacement, and revocation, because those are different decisions even when both use passkeys.
- Define who owns credential revocation Specify whether the issuer, the user, or a sync provider can invalidate a credential after device replacement or compromise, and make that ownership explicit in policy.
Bottom line: Device-bound passkeys shift control from a consumer sync layer back to the issuer, which changes how identity teams think about recovery and revocation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:34 pm
Device-bound passkeys are a control model, not just an authentication method: Singpass is not simply adding another login option. It is choosing a credential custody model where the issuer retains tighter control over issuance, locality, and revocation. That matters because identity governance is ultimately about who can bind, move, and retire credentials, not only how users unlock them. For national and regulated identity systems, the practical conclusion is that passkey design choices are governance choices.
A question worth separating out:
Q: How should identity teams evaluate passkeys in a national or regulated ID system?
A: Evaluate whether the passkey strengthens issuer governance over authentication, recovery, and revocation, not just whether it removes passwords. In a national ID system, the right question is whether the credential stays under the issuer’s control enough to support strong assurance, clean offboarding, and reliable session binding.
👉 Read our full editorial: Device-bound passkeys change identity control in Singapore's Singpass