The End of Traditional Passwords

Passwords have been the typical option for people to protect online accounts for decades. Almost everything from social media to banking accounts requires one. However, passwords have also become one of the biggest weaknesses in security.

There are several ways in which passwords can be stolen by hackers such as by phishing or through data breaches. However, a new password substitute has recently emerged called passkeys. Passkeys are designed to solve many of these problems and could eventually replace passwords altogether.

A passkey is a digital credential that users can useto sign in to online accounts without entering a password. Once a passkey is set up for an online account, users can sign in the same way they unlock their device, such as with Face ID, a fingerprint, or a PIN.

Passkeys use public key cryptography. When a passkey is created, the device creates a public and a private cryptographic key. The website stores the public key for future use, while the private key remains protected by the user’s device.

When you sign in, the website sends a request to your device to make sure it’s really you. Once you unlock your passkey, your device proves your identity using the private key, and the website confirms it using the matching public key.

The important part is that the private key itself is never sent to the website. This means a company does not need to keep a database containing users’ passwords that could later be stolen in a security breach.

One of the biggest advantages of passkeys is their resistance to phishing. A fake login page can trick someone into typing a password because the person may not notice that the website is fake.

Passkeys work differently because each credential is connected to the website for which it was created. A passkey made for a legitimate website cannot simply be used by an attacker’s fake domain. This makes stealing login credentials through traditional phishing much more difficult.

Passkeys are based on guidelines developed by the FIDO Alliance and use technologies including FIDO2 and WebAuthn. These guidelines allow different websites, browsers, and devices to support authentication without the need for passwords.

Passkeys can also be safely shared across a person’s devices through syncing. This makes them more convenient because losing or replacing one device does not always mean losing access to every passkey.

Passkeys solve many problems with passwords, but they do not remove every cybersecurity risk. Synced passkeys depend on the security of the account and service used to synchronize them. Account recovery is also important because attackers may try to target the recovery methods used instead of attacking the passkey itself.

Organizations still need strong security around devices, account recovery, and access controls. Passkeys should be treated as an upgrade to authentication rather than a solution to every type of cyberattack.

Major technology platforms and online services are increasingly supporting passkeys. NIST has also published guidance for the use of them, showing that authentication without passwords is the future of security standards.

As the use of passkeys increases, passwords may slowly become less common. Instead of having to remember long and complicated passwords, users could securely sign in using information already stored and protected by their devices.

Password protection of online accounts has been common for years, but also brings a number of security challenges. Phishing attacks, password reuse, stolen login information, and large data breaches are all common problems.

Passkeys offer a more secure way to login than passwords. They use cryptographic keys to verify users. Such keys are far more difficult to be stolen or to be compromised than traditional passwords. Although passkeys are not perfect, they could make signing into online accounts both safer and easier in the future.

https://developers.google.com/identity/passkeys

https://fidoalliance.org/passkeys/

https://pages.nist.gov/800-63-4/sp800-63b/syncable/

https://www.nist.gov/publications/nist-sp-800-63b-4digital-identity-guidelines-authentication-and-authenticator

https://fidoalliance.org/white-paper-passkeys-the-journey-to-prevent-phishing-attacks/

https://www.w3.org/TR/webauthn-3/

https://pages.nist.gov/800-63-4/sp800-63b/authenticators/