Passkeys

 The big tech companies are getting together to do something about the insecurity of passwords. The FIDO Alliance--Apple, Microsoft, Amazon, Google, and others--and WC3 are pushing to implement passkeys as a replacement for passwords to login to your web accounts.

Passkeys use public key-private key cryptography. Your device works with the website or app to create a passkey with a public part, analogous to a lock, and a private part, analogous to a key. You own the key and maintain possession of the private part; it never leaves your device.

The credential manager (a.k.a. password manager) on your device manages passkeys once they are set. You only have to remember how to unlock your device. Since this may be a biometric such as facial recognition or your fingerprint, you may not have to remember anything most of the time. If you use a password or a PIN to unlock your device, you will have to remember them (or write them down someplace secure away from your device).

Passkeys are much more secure than passwords. Passwords reside on both your device and the website. You hope the website's copy is encrypted and secure, but you never know. With passkeys, even if a hacker breaches the website and steals the account data, he would get only the public key, which is useless without the private key that is safely stored only in the credential/password manager of your local device.

These "keys" are long, random numbers with a mathematical relationship to each other. They are used to encrypt information sent and decrypt information received.

Public key-private key technology is not new. It's been around for 50 years. Its application to signing in to apps and websites, i.e., passkeys, is new.

You may have already encountered a website asking if you wanted to set up a passkey. Members of the FIDO (Fast Identity Online) Alliance are already implementing it on their websites. Since the Alliance includes some of the biggest tech companies and consumer companies that depend on security for their customers (Bank of America, Intuit, PayPal, Vanguard, others), use of passkeys will likely spread quickly.

Once you create a passkey, future logins will be more direct, faster, and more secure. The passkey is directly and uniquely tied to your account. Your account will be identified by three factors: the website domain (e.g., walmart.com), your account user identity, and the public key part of your passkey. All three must be present to successfully access your account.

Use of passkeys will significantly reduce successful phishing by hackers. For example, if you were to fall for a phishing email with a well-designed webpage pretending to be your bank, but with a fake domain, your credential manager, where your private key is stored, will not allow you to send your credentials to the fake webpage because one of the three requirements, the correct domain, is not present. In other words, you can not inadvertently reveal your private key to the hacker.

You have options for which credential manager you use. The choices include those built in to your operating system or browser and those provided by third-parties such as 1Password, Bitwarden, and others. You may use more than one, but it could get confusing. Your credential manager literally holds the keys to the kingdom (of your accounts). Thus you should protect it with a strong password, a biometric, or a passkey.

It will be a few years before all websites and apps have implemented passkeys. You should plan for now to continue to use strong passwords, a different one for each account, and multi- or two-factor authentication to access your accounts.  Meanwhile, you should begin to use passkeys for every account you can. You will soon be on your way to a more secure and easier to use future.