## 7 Lessons Learned and Discussion
Furthermore, since passkeys are generally very simple to use during an authentication flow, users sometimes associate this ease with a less secure process. This might be because users associate more work with a more secure process and vice versa. At the same time, through the recent support of big operating systems and browsers for passkeys, it can be seen that a boost in awareness and guidance for end users has been achieved. We note, however, that while this is a good thing, the technical challenges, especially the transferability, must not be forgotten when relying on big tech companies to address this user perception issue. Suppose standards for the transferability of passkeys are lacking. In that case, these companies might use the opportunity to educate users and encourage them to create and use passkeys within their respective ecosystems while ensuring that transferring passkeys to another ecosystem is difficult. This could effectively lock end users within their respective ecosystems. A general observation common to all three subcategories is the need for general standardization in the implementation and use of passkeys. Standardization not only facilitates more streamlined development and integration across diverse platforms and devices, but it also mitigates security risks and attack vectors by reducing the likelihood of misconfigurations and implementation errors. From the user's perspective, standardized passkey experiences can ease the adoption process by minimizing the cognitive load associated with learning different user interface paradigms from multiple providers--an important consideration in the context of an already significant paradigm shift away from passwords. Similarly, for service providers, having agreed-upon conventions--like the common structures seen in login or sign-up pages--can simplify implementation, promote best practices, and foster greater interoperability within the authentication ecosystem. All aiding to a potential faster adoption, reduced confusion with privacy concerns, and increased security improvements by moving away from passwords. As seen with the nudging of users from larger corporations, it can be suggested that standardization highly relies on larger corporations such as Google, Meta, Microsoft, FIDO Alliance, etc., for an increased likelihood of adoption. We note that as outlined in the improvements section, the technical and usability categories show great potential regarding improvements for an end user, with the potential to improve authentication processes in the long term. The same cannot, however, be said for the category of user perception since passkeys, from that perspective, do not bring many improvements and thus have a lower impact. We note that while multiple technical challenges exist from an end user's perspective, many of them could be addressed through improved standardization and/or improved implementations from the respective providers. To give a final overview of the impact of the identified challenges and improvements for the adoption of passkeys, we rate each category in terms of improvements and challenges with an importance factor from an end user's perspective. The rating is based on a scale from one to three, with one being low and three being high impact. Figure 6 shows the ratings that were derived based on the detailed insights. The exact rating values are also shown in Table 6 for completion purposes. Considering the immense positive impact regarding improvements in the technical category, we give a score of two for the technical category in the domain challenges and a score of three for the domain improvements. For the usability category, it can be noted that not all issues have been resolved. Still, much academic research and progress have already been conducted, greatly improving the challenges for an end user in this category. Therefore, we give a rating of one for the domain challenges and a rating of two for the domain improvements.