You may have noticed being offered to use a passkey when creating an account on a website, even a website you use often. If you don’t know what a passkey is, you probably don’t understand the benefits and don’t opt in. Here I want to scratch the surface to explain why you should be saying yes to using passkeys when offered.
The weakest link in the cybersecurity of your business is likely to be all those passwords used across all the functions and processes you rely on to keep your business operating. You rely on passwords to protect your key internal platforms (e.g., databases and applications like finance, payroll, and HR) as well as connections to external providers like banks, suppliers, and customers via their websites. The problem with passwords is that they get forgotten, reused, guessed, stolen, bought on the dark web, and willingly handed over to bad actors via convincing phishing emails. We accepted the use of passwords because most alternatives (or add-ons) were cumbersome and expensive.
A newer technology, passkeys, represent the first genuine replacement for passwords that is both more secure and, in most cases, easier to use. Passkeys enable you to log in without needing to create, use, or remember a password. But they aren’t simply another way of logging in. Passkeys fundamentally change how we prove our identity online.
Passwords have been a necessary security layer for years. Fundamentally, we need them because bad actors want to access and misuse our data, generally for their profit. Of course, passwords help prevent this, but it largely meant the bad actors instead want our passwords. We merely shifted the security burden and targets of attack. Passkeys represent a realistic model to end the reliance on passwords, and cost effectively improve security in our hyper-connected businesses (and lives).
There is no such thing as a perfect technology. There will always exist flaws that can be exploited. The question should never be ‘are passkeys perfect?’ but rather ‘are passkeys the right step forward from passwords?’
Overwhelmingly, yes.
The Problem Being Solved
Computer passwords were originally meant to secure the computer and the applications (‘programs’ or ‘apps’) running on them. The threat was that an unauthorised user could access your internal systems, and through that, your company data. To effect this data breach, they would need to be physically at the device or terminal. Computers were isolated (‘air gapped’ in modern parlance). Without a username and password, no one could access the system. Usernames were the ‘public’ part of the security handshake. The password was the secret.
It wasn’t that long ago that PCs could be easily breached by having access to the PC, and simply rebooting the device. Without expensive add-on hardware and software, physical access to a PC meant access to the data on that PC. Data security basically consisted of application-level passwords and possibly data encryption. Encryption meant the data were useless to someone without the encryption key to unlock it. This is also its biggest weakness if you lost the key, or it is corrupted, the data are likely irrecovable.
In the late 1980s, early versions of PC operating systems (OS) started enabling OS-level passwords as already used on mainframe and mini-computers (including all UNIX variants). As PCs and other computing devices proliferated and started being networked, new levels of password-based protection were needed against a new threat: the remote attacker. Devices no longer needed a bad actor to be physically at a terminal or PC: they could be in another room, or (via modems and later the Internet) in another country. A key change in this environment were authentication processes that recognised invalid username/password combinations, locking out login attempts after a certain number of attempts (e.g., three to five tries). A security (or systems) administrator would need to manually authenticate the user (e.g., via a phone call) before resetting the password and the failed attempts counter.
Most businesses today rely on dozens or even hundreds of password-protected online systems. In almost all cases, remote password reset is done via an email reset. The security logic for this is that only the legitimate user should have access to their email address, so sending an email with a link to request a password reset to the registered user’s email address should be sufficiently secure.
Passwords operate on some variant of a user-level challenge and response model between the user and the server (the software running the website or shared resource). The server system relies on you creating an account via some process, and then setting your password. You type in your password which is sent to the server and stored (ideally in an encrypted form). When you log in, you enter your username and password. The server system matches your account (username) with the password it has stored. If they match, the server has authenticated the user. If they don’t match, the user’s attempt to login is rejected.
As the number of critical online services grew, businesses started seeing problems with password hygiene. Problems like:
- Users reusing a common password across multiple sites
- Users sharing passwords
- Users writing passwords down, often finadable upon a cursory search of a person’s work environment
- Users using weak passwords (easily guessed or trivially hacked)
- Users forgetting passwords
In reality, none of these are failures of user discipline. Humans are terrible at managing dozens of unique secrets. The issues above are simply the byproduct of human behaviour.
Most contemporary mitigation approaches to these issues are at best stopgaps. Implementing strict password rules (e.g., frequency of change, password expiry, no repeated passwords, minimum password length, use and/or prohibition of special characters) drive users to reuse common passwords (less to remember) or write the passwords down. Using password managers is a simplistic salve – outsourcing your security to an unknown third party, whose motives are far from transparent. Again, bad actors moved their focus to breaching these password managers, with around half of the commercial solutions being compromised in some form or other (but no known breach of encrypted data). The issue remains: the bad guys want your data, and they will beg, steal, threaten, or guess.
Another solution to strengthen passwords is 2FA (two-factor authentication) and MFA (multi-factor authentication). These rely on essentially having two authentication mechanisms in operation at the same time. In most cases, username/passwords are still used, plus an additional step being added, like being sent a code via email or SMS that you need to enter, or the use of a pre-issued token with a code that changes on regular intervals. These are a degree harder to break, but not impossible.
Adding these security measures adds expense, and reduces convenience. Passkeys, on the other hand, make systems more secure and easier to use. That’s not to say passkeys will eliminate cybercrime, and in some cases they can be more inconvenient than passwords.
Ensuring You Are on the Right Website
One of the capabilities of passkeys is that your passkey for a specific website will only work with that specific website.
When you use a username/password authentication approach, you need to decide where you are using it. This sounds pretty basic, but it is extremely important. If you’ve been conned by a bad actor to go to a realistic fake website rather than the one you intend on, you could quite willingly type in your username and password to that fake website. The bad actor now knows your secret. And if you have a habit of reusing passwords, you may have given them access not just to that website, but many others as well.
It doesn’t matter how many times you are told to confirm a website’s address, most users still don’t. They are busy, it’s inconvenient, too much hassle. Clicking on a link in a legitimate-looking email is so much easier than typing in the address yourself, moreso if you can’t remember the actual URL. The bad actors can use a homograph attack, using substitute characters (e,.g., from another language’s character set) that appear to the user to look like the site they want to go to (simplistically, like using a lower case l (L) in place of an uppercase I (i)). When you get there, those fake websites can be very convincing: screen scraping and AI can be used to quickly produce almost perfect copies. Unless you are paying close attention, you miss that the site is fake. You enter your username/password. The bad actor now has it. The fake website then diverts the connection to the legitimate site’s ‘invalid password’ page. You think you made a mistake, you try again. Now it works, so you think nothing of it. You have totally missed that you’ve handed over your legitimate password to a bad actor.
An important point here is that a valid digital certificate doesn’t prove a website is the one you intended to visit. It only proves that the website controls the domain name shown in the address bar. That little padlock in the address bar doesn’t guarantee you are where you want to be. All it tells you is that the digital certificate has been issued to that domain name. If you think you are at ibm.com, but you are actually at Ibm.com, all a certificate tells you is that you are indeed at Ibm.com. Anyone that controls a domain name can get a valid certificate for that domain name. No one checks if that name could be spoofing another site.
Better Security, Less Hassle
We have tolerated the downsides of passwords due to the absence of other methods. Part of this trade-off is the addition of inconvenience in the form of add-on devices, password rules, and poor password hygiene in order for users to be able to keep up. Passkeys, though, truly represent a significant leap forward in both device security and convenience.
It is critical to understand that passkeys aren’t a password manager. The password manager model can feel the same as passkeys to use: When you create an account, the password manager suggests a strong password, and if accepted, that password is stored (locally or in the cloud) in an encrypted form. When you return to that site, the password manager recognises the URL, and pulls the username/password combination from its database, and ‘stuffs’ them into the appropriate login field. All you need to do is hit ENTER or click the login button. Password managers assist by taking away the need for you to remember lots of username/password combinations, but they maintain the underlying password-based authentication model. Passwords are still a weak link.
The key to the success of passkeys is the elimination of passwords in most situations. No passwords to remember, or at risk of being disclosed. Your device (PC, mobile phone) undertakes the authentication for you, typically based on face recognition or other biometrics. Passkeys rely on public keys being held by the device serving the app or data (e.g., a website or server), with private keys being generated by your device when needed for authentication. The passkey software on your device communicates with the provider system and generates a unique key to match the public key. This private keys never leaves either device. They are simply used in a secure algorithm to match the public and private keys. If there is a match, the user can proceed. The user doesn’t know or see the private key. There’s nothing to remember or write down, and therefore no password to be stolen, or guessed, or reused. The passkey cannot be used on a different website, and a fake site can’t grab and use the passkey.
All this can seem something like magic. You visit a website, then scan your finger or face or similar on your device, which then tells the website you are the authorised user of that account. Nothing for you to remember, nothing to be stolen or intercepted.
Below the surface, the process is akin to account creation with a password. You go to the website and create an account. You don’t enter a password. Your system uses a public key generated by the website (which is not a secret, and can be known by anybody), generates a matching electronic unlock key (your private key for that site), which it stores locally (encrypted), and returns it to the server to ‘prove’ the user is valid. In subsequent visits, your system simply needs to send the username, receive the public key, algorithmically merge the public key and private key, and send the response to the server. The private key is never revealed or shared, unlike a password.
If a bad actor hacks the website, there’s nothing of value to steal. They can get your username and the public key (unless the site stores these in an encrypted form). They can’t use the public key anywhere else – the public key used for your access was generated solely for you, but reveals no secret. The site doesn’t know, and therefore can’t store or share, your private key.
Even if someone gets access to your private key, it only works with a single website – it can’t be reused anywhere else. And to use your public key, the device being used for login still needs to biometrically authenticate you, so it is useless without your face or fingerprint or whatever local authentication is used.
Similarly, if you somehow end up on a fake website masquerading as the legitimate one, your passkey won’t work. Your device will only recognise the genuine website it was created for, making phishing attacks dramatically less effective.
In practice, the user experience is seamless. The login handshake happens quickly, requiring you to use your face, fingerprint, or PIN only. The exact mechanics are not important for you to understand. Knowing that the system is trustworthy, and does away with the need for passwords, is as technical as you need to go.
Fundamentally, a password says here’s my secret to prove it is me. A passkey says I can prove who I am without ever revealing my secret.
Are Passkeys All Good News?
As I state above, there is no perfect technology, and there are no perfect security systems. I will attempt to discuss the issues with passkeys in a later article. The key thing to note is that passkeys are a major step forward in online security, and that the weaknesses with passkeys are inherent in other methods, like passwords. Where passkeys are available, it is recommended you use them.