## 7 Lessons Learned and Discussion
These improvements also lead to greater phishing protection, which allows for greater peace of mind from an end-user perspective, as it is no longer possible to accidentally type the password into the wrong website, etc. Research, however, also suggests that some significant technical challenges still need to be addressed by enhanced standardization and/or more consistent and correct implementations to increase passkey adoption, especially in the enterprise environment. We note that these technical challenges highly affect usability from a user perspective. Still, they are only solvable from a technical perspective; therefore, we list them here in the technical category. These technical challenges are as follows:  
* Account sharing. Currently, only a few solutions allow for the sharing of passkeys among multiple people. Usually, they are either very technical and rely on a specific protocol implementation, like in [92], or require a more complex password manager setup and usage of all involved people of the respective password manager or the sharing of a hardware key, which also gives access to other accounts. Especially in the context of enterprises, where account sharing and delegation are crucial for day-to-day business, these issues need to be solved to achieve a higher adoption rate of passkeys. We, furthermore, note that resolving this issue needs to be achieved in a way that does not weaken the high protection of passkeys against phishing attacks. * Passkey recovery. Despite this being tied to the high-security guarantees of passkeys, research suggests that many people fear losing their passkey(s), and therefore, losing access to their accounts. While this is not directly solvable by changing the passkeys themselves, it can be achieved by building standardized and secure ways of synchronizing passkeys among different devices, potentially allowing for restoring passkeys to a new device. We note that recent research has already started to propose solutions for this, like in [31] or [72], and standards like [104] have been released, focusing on setting secure guidelines. Additionally, we note that it is important to solve this problem while keeping the next point in mind. * Transferability. Related to the previous point, another key challenge is the transferability of passkeys. While it is good from a security perspective that passkeys are often tied directly to a hardware key or the device, this is not practical for many end users, as they can lose or damage devices, lose keys, or want to transfer their passkeys easily to their new device or service. Therefore, there needs to be an easy, standardized, and secure way of exporting or transferring passkeys to another device or system. Similar to the account sharing challenge. This must be achieved without weakening the protection against phishing attacks. In the category of _usability_, we also observe that the state of research suggests multiple improvements. Passkeys have become very easy to use through the recently added support for passkeys on many big operating systems and browsers, as well as the many research projects that identified usability challenges and proposed corresponding improvements. At the same time, they address the most significant issue of old authentication methods, like passwords, of having to remember some secret. The only challenges that could be identified in this area were mainly issues around the setup and the usage guidance of passkeys. However, we note that research also suggests that passkey providers, etc., are attentive to the academic results around usability and improving upon the challenges. The area of _user perception_ shows the most amount of challenges from a user-centric perspective. Simply put, research suggests that there is still room for improvement regarding user awareness, knowledge, and guidance about passkeys and their use. Many research projects show that users often think of passkeys as a black box and do not know what is happening behind the scenes.