Does the use of a passkey (FIDO) link your physical device id, eg IMEI, to that specific passkey?

Question

Passkeys are being introduced.

From what I understand so far, a passkey involves the storage of a private key, and retention of a public key with the internet service. Eg Google, Apple, Microsoft, Reddit, StackExchange, etc.

Does the formation of a passkey, or the subsequent use of a passkey by itself alone, identity the hardware device the passkey is used on, and thereby potentially can be used to link all other activity that is associated with that hardware device to that passkey and that user?

The answer to this question may depend on the company/internet service that generates the two keys, private and public, to enable a passkey interaction.

For example, is it possible that a company can use the device IMEI as part of the construction of the passkey? Then at the back end in some fashion using the passkey to link online activity to that physical device and hence the user. Thus enabling the passkey to become a universal identifier for data collection of the user across different sites.

Answer 1

Passkey (and FIDO in general) generates keypairs on the device rather than on the server.

The web servers can only know the type of device that generates them, but can't tell the specific model. This is because of the information included in the data format used for key attestation.

The device provide different public keys to different websites to preserve privacy.

If you'd like a bit of technical details, here's info from Mozilla Developer Network.

---

For example, is it possible that a company can use the device IMEI as part of the construction of the passkey? Then at the back end in some fashion using the passkey to link online activity to that physical device and hence the user.

For this specific concern, yes, the said company will be capable of doing so with custom information in attestation information. But the normal browsers everyday people would use (Edge, Firefox, Chrome, Safari, and a few others) doesn't produce attestation information in proprietary format, so that's not a big concern, at least not "on the web".