Could Passkeys Be The Future of Authentication Technology?

Let’s face it, passwords are becoming a liability and they are downright painful for users to remember, safeguard and use properly. We’ve come a long way since the days of QWERTY and Password1234, but honestly, not everyone uses a password manager and keeping track of every login and the appropriate credentials takes time, not to mention the added cost of Two-Factor Authentication used by many businesses. So what’s the solution to the problem of password security? One option that’s existed for a while but recently gained traction is the authentication technology called Passkeys (formerly called FIDO). This modern version of hardware keys is becoming popular, so let’s explore what they are, how they work, their benefits and who’s already using them.

What Are Passkeys?

A passkey is a credential stored on your computer or phone, and it is used to unlock your online accounts. In short, a passkey is a cryptographic key designed to replace passwords so many in the IT field refer to them as a passwordless login. Passkeys are different from passwords in that they cannot be shared, remembered, or written down. This makes passkeys far less vulnerable to the types of attacks that commonly target password-based systems such as phishing scams.

How Do They Work?

Passkeys have two key parts that make them secure and easy to use. There is a private key store on your device that is created when using the screen lock functionality such as a fingerprint, pattern, facial recognition or pin. That private key must match a public key that lives on the server. Since there are no secrets being stored on the server, data is not vulnerable to server breaches as they are when using passwords. Google explains it best saying, “To sign into a website or app on your phone, you just unlock your phone — your account won’t need a password anymore. Or if you’re trying to sign into a website on your computer, you just need your phone nearby and you’ll be prompted to unlock your phone — which will then grant you access on your computer.”

What Are The Benefits of Passkeys for Users & Developers?

Passkeys offer a few key benefits to both users and developers including simplicity of use, convenience, and robust security. Since security is foremost in the minds of most business owners, it is important to note that passkeys are resistant to security issues such as phishing scams and offer cryptographic security that translates into better overall safety features. Furthermore, biometric information does not leave the device and is never shared with service providers, keeping sensitive data secure. Developers, in particular, support the adoption of passkeys as they allow for improved conversion rates, reduce maintenance costs and costs associated with two-factor authentication as well as provide for easier compliance with regulatory requirements such as HIPAA. Users benefit from passkeys because they no longer need to remember a password or verify two-factor authentication to access data. Their access is dependent on something they are (biometrics) and something they have (a device) making logging in easier and more efficient especially for workplaces that have many clients with multiple login credentials.

Who’s Already Using Passkeys?

While many of you may not have heard of Passkeys, they are actually already being used by many browsers, websites, Apps, and services. Several popular browsers have integrated passkey support, including Google Chrome (version 109 or later), Apple Safari (version 16 or later), Microsoft Edge (version 109 or later) and Mozilla Firefox (currently with limited support). (Sources: Passkeys) Many websites are already enabling Passkeys for better security including Github, Dropbox, and Paypal. E-commerce sites such as Amazon, Walmart, Best Buy, Target, Shopify, and Kayak have also started offering this security feature. For more information on Passkeys or to discuss the security of your websites and networks, talk to our team at Spectra Networks.