Few Internet users can recall the anxiety of the forgotten password. While creating another password is an option, a new character string has to be memorized in any case, and the password complexity rules must be followed. Using a passkey involves a different set of actions that is simpler.

What a Passkey Is

A passkey is a form of a password, but the person who needs to provide it does not have to remember it. This security token can be “generated on your device using a biometric,” reports Google.

In addition, passkeys can be stored in the same place as other accounts. In short,

a passkey is a way to gain access without typing and remembering a complex string of characters.

However, the mechanism involves a somewhat confusing set of instructions for the uninformed.

FIDO Alliance reports that passkeys “are pairs of cryptographic keys,” one of which is used publicly while the other remains private to secure the former. Thus, a user does not have to type a password; instead, they authenticate using facial recognition or a fingerprint. The latter means that a passkey is a token that must be recognized as a valid form of identification.

The method is immune to eavesdropping because, as

Google reports, the FIDO alliance “has revolutionized the way we sign in” using “public-key cryptography” algorithms. The user’s biometric data or secure code, such as a PIN, is used to “authenticate your identity” rather than provide credentials to every website and application. To illustrate the difference, a comparison between a password and passkey can be made. The former has been subject to phishing techniques for decades. One example can be “a student who unknowingly enters their credentials at a spoofed website,” states FIDO Alliance.

An example of a passkey can be a similar scenario but with a school account. The student clicked a link that looked like a legitimate school website, but the login page did not accept a password, so the credentials were not at risk. Meanwhile, the student was informed that passkey sign in was not available.

The Challenges Are Ahead

Innovation, especially in technologies that involve human interaction, is only viable if people understand it. In this regard, a passkey faces the challenge of the confusing instructions. Users do not want to lose access to their accounts, which may become a reality if they change devices often. This factor, together with the inconvenience of learning the location of an authentication application, can prevent the adoption of a passkey.

Still,

Google is confident, as its Safety Center page on the technology indicates, that they can “add a passkey to your account alongside your password.” In other words, switching to a new authentication method does not affect the existing approach, but an organization needs to provide clear instructions on its use in case a user forgets a password or changes a device.

Thus, a passkey is a great technology because it simplifies most aspects of the authentication process and removes the need to memorize complex passwords. Meanwhile, the instructions to use it should be clear to all users to ensure their safety. One day, the Internet will become a safer place because not every detail of an account can be stolen and used to hack a system.

Sources

  • Google Safety Center. “[Passkey: Simple and Secure Passwordless Sign-In] (https://safety.google/safety/authentication/passkey/).”