I have been writing about the impact of bad passwords since 2010. One of the most appalling bad password statistics comes from the Identity Theft Resource Center (ITRC). They have tracked over 1 billion data breach victims in the first half of 2024. Enough is enough, there is finally a workable answer to passwords: passkeys.
Passkeys were developed by the Fast Identity Online (FIDO) Alliance to log in to apps and websites without using a username and password combination. Instead, a passkey uses a pair of cryptographic keys generated by your device to unlock your account. Google and Apple will store your unique public key. Your private key is only stored on your device, and after your device authenticates your identity, the two keys combine to grant you access to your account.
According to FIDO research, 38% of consumers (PDF) are not familiar with passkey technology. A significant percentage of users do not understand passkeys, let alone trust them to protect their data and identities.
How passkeys work: A step-by-step guide
Unlike traditional passwords, passkeys utilize public-key cryptography. That means every passkey has two parts: a public key and a private key. Together, they keep your accounts secure by allowing websites and apps to check that you are who you say you are. Here’s an overview of the passkey process:
- Creation: When you create a passkey, your device generates a pair of cryptographic keys – a public key and a private key.
- Storage: Apps or websites store your unique public key, while your private key is only stored on your device. After your device authenticates your identity, the two keys combine to grant you access to your account.
- Authentication: When you log in, the app or website sends a challenge to your device. Your device uses the private key to sign this challenge, proving your identity without revealing the private key.
- Verification: The app or website verifies the signed challenge using the public key. If it matches, you’re granted access.
The benefits of passkeys:
Strong by default: You don’t have to create anything manually or worry about whether your private key is long or random enough.- No Need to Remember: You only need to authenticate with biometrics (or your device passcode) to sign in to your account.
- Private Keys Are Never Shared: You don’t have to worry about how the website is storing your credentials.
- Public Keys Can’t Be Used to Figure Out Your Private Key: If a criminal breaches a website’s servers, the best they can hope to find is your public key. The public key cannot be used to sign in to your account. Nor can it be reverse engineered to reveal your private key.
- Strong Defense Against Malware: Criminals often create fake but seemingly authentic websites to trick you into sharing your login details.
- Protection Against Ransomware: Many ransomware attacks start with social engineering emails. Once in, they continue by installing keystroke sniffing software that can watch people enter their IDs and passwords.
- Improved User Experience: Signing in with a passkey is more convenient, faster, and smoother than using traditional passwords.
Why you should use a passkey instead of a password
Securing your online accounts is more important than ever in today’s digital age. Traditional passwords have been the go-to method for authentication for decades, but they come with several drawbacks. Here’s why you should consider using passkeys instead of passwords:
Enhanced Security: Passkeys use public-key cryptography, which involves a pair of cryptographic keys: a public key and a private key.- Convenience and Ease of Use: Remembering multiple complex passwords can be a hassle.
- Protection Against Phishing: Phishing attacks are a common method used by cybercriminals to steal passwords.
- Reduced Risk of Data Breaches: Data breaches often result in the exposure of millions of passwords.
- Seamless Cross-Platform Experience: Passkeys are designed to work seamlessly across different devices and platforms.
- Future-Proof Technology: As technology evolves, so do the methods used by cybercriminals.
Some consumers still don’t trust this form of security because they assume that anyone stealing their phone could log into their accounts. This isn’t true, as the criminal would still need your face, fingers, or eyes.
rb-
Even if you don’t fully trust passkeys, you should distrust your passwords more. It’s likely that your credentials have already been stolen and are on the dark web.
There is wide consensus in the tech community that passwords are an unsustainable security framework. Even password managers that let you use one strong master password could be at risk. First, some of them have been hacked and then there is the risk that those protected passwords are no longer secure.
A reasonable answer
A passwordless system is the only reasonable answer.
There is not a single passkey to solve all problems. You will have different passkeys for different systems and platforms.
However, this doesn’t really matter. The signup for passkeys is easy and consistent on all platforms in that there will never be a password attached to it. It will use the same biometrics you use for your other platforms, services, and their respective passkeys. In other words, it can feel like it’s one passkey for all online systems.
While passwords have served us well for decades, it’s time to embrace a more secure and convenient alternative. Passkeys offer enhanced security, ease of use, and protection against phishing and data breaches. By making the switch to passkeys, you can enjoy a safer and more seamless online experience. It’s true that the industry is still doing a poor job of explaining why you should embrace passkeys, you should like it because passkeys will ultimately save your data and digital identity.
Are you ready to make the switch to passkeys? Let us know your thoughts!
Related article
Ralph Bach has been in IT for a while and has blogged from the Bach Seat about IT, careers, and anything else that has caught my attention since 2005. You can follow me on Facebook or Mastodon. Email the Bach Seat here.
Less than 6 months after John McAfee was found 
The article says these incidents highlight the growing risk of school kids’ vulnerability to identity theft. Across the country, schools have become conduits for children’s pristine Social Security numbers. The students’ numbers are increasingly falling into the hands of credit-hungry identity thieves. The frequent data breaches have prompted calls for schools to stop collecting sensitive student data. The breaches have angered parents like Art Staehling, whose 14-year-old daughter was among 
