Speaker: Dr. Dominik Schürmann

Synced passkeys are becoming the default for passwordless login. But a passkey is only as trustworthy as the manager that stores it. Choosing that manager is therefore a question of digital sovereignty.

This talk narrows down the market from a European perspective: system solutions from Google and Apple tie credentials to consumer accounts that can be suspended, and Google does not end-to-end encrypt by default. US vendors depend on the EU-US Data Privacy Framework, which is under political pressure. The 2022 LastPass breach and the BSI study on password managers from December 2025 reveal significant weaknesses in encryption and manufacturer access.

The second part covers architecture: hardware-bound keys protect again ...