The passkeys are an excellent solution… when you’re not doing Bring Your Own ID or identity federation.
A clear stance from Fabien Schwebel, Europcar’s CISO. He voiced it at the Security Assizes, while presenting the alternative option chosen by the company: FIDO2 keys (Yubico).
The project began in 2021 on a “budget remainder.” Europcar had MFA, but “old-school,” to borrow Schwebel’s words. Namely, Google Authenticator, “with codes that were transmitted.” A deployment vulnerable to phishing (risk of session token compromise), on top of not eliminating passwords.
It was decided to develop this project in synergy with another initiative aimed at implementing SSO (Red Hat). The physical keys would secure access to this portal, which would then unlock access to the applications.
The passkeys in Chrome, a poisoned gift for Europcar
Europcar therefore rejected the passkeys. Primarily because, especially at the time, it was a “very closed standard, [with a] vendor lock-in” of significant magnitude, according to Fabien Schwebel. “The key is in your iCloud, in your Entra ID, etc. and the user cannot move to another ecosystem.” Moreover, he notes, it violates a fundamental cryptographic principle, the key should not move. Indeed, if a user signs in on a new device, their key is downloaded into the local TPM.
The push of passkeys by software vendors posed problems for Europcar. Its CISO points, in particular, to Google, which eventually made it the default authentication method in Chrome. Testing beta versions of the browser, the company saw it coming. “We almost saw a snake biting its own tail and perhaps hundreds of thousands of help-desk calls.” And for good reason: Europcar uses Google Workspace as its primary email. Its employees would have found themselves enrolling a passkey on their Google account to unlock that same account…
Biometric keys for Active Directory admins
Europcar also ruled out the idea of deploying FIDO2 with its phones and laptops. The reason: the fallback needed to cover cases where a user must switch devices represents a vulnerability.
The company settled on Type-C to simplify stock management. For devices still using Type-A, it purchased adapters. It did not generalize biometric keys—substantially more expensive—but distributed them to specific populations such as security solutions administrators or Tier 0 Active Directory admins.
Going passwordless… and credentialless?
The first authentication flow implemented remained login/password at the SSO level. It implied registering the key across downstream applications.
In a second phase, FIDO2 was moved to the IdP. The YubiKey being considered secure, passwords were removed — not for all use cases, though. This allowed BYOD for certain applications (no password exposure on unsecured devices).
At deployment time, there was no strong authentication in Windows in the sense that the user could opt to sign in with a password. Europcar therefore stayed with traditional on-device authentication. It is once the session is opened that the keys come into play.
After passwordless, the third step is usernameless. Leveraging the fact that the key can store the user’s identifier, it is still nascent at Europcar, but it “drives a massive win in buy-in.”
Aligning with existing logistics
Europcar operates about 2,700 branches. It employs just over 9,000 people, excluding seasonal staff and “hikers” (the ones who move, clean, and prepare vehicles).
People without access to the IT stack can use a platform authenticator. That is, a built‑in module on a device—typically their smartphone. Others use a YubiKey (VIPs have two, with a spare kept at home).
Europcar leveraged its existing logistics to the fullest (distribution of IT hardware, uniforms, badges…). For offshore third parties who procure their own hardware, it mandated cross‑platform FIDO2 authentication.
Branding keys to curb their value on the secondary market
The keys ship in blank. There is an auto-enrollment process (employees receive a one-pager with a QR Code). There are workarounds, acknowledges Fabien Schwebel. But there are also deterrents. For example, passwords expiring every 30 days.
To mitigate losses (a rate of a few percent), the agencies keep spare keys. Except at the largest locations, IT support is remote. The presence of colleagues nonetheless facilitates authentication at the help desk. This does not prevent Europcar from conducting red teaming in several languages.
To diminish their value on the secondary market, the keys are branded. “In projected printing, [thus] if technically one can scratch them, it damages them…” Europcar also practices the invoicing of local teams. In other words, the manager pays for their keys. “If an employee loses two in three weeks, it costs the station’s P&L a lot…”
Citrix sessions and multiple profiles
Since workstations aren’t typically fixed, Europcar relies on roaming Citrix sessions.
Users can use their YubiKey to protect personal accounts. The company does not encourage it, not least because the key must be returned at the end of the contract. It does, however, leverage the ability to store multiple profiles to allow users to sign in to generic accounts as well.
The deployment of physical keys enabled negotiating with auditors an extended password expiration window (one year instead of 60 days).
Europcar keeps a close eye on the application ecosystem, including Google, which places enough emphasis on passkeys in Chrome that a user with a physical key would have to “click the small, slightly greyed-out option”…
