Passkeys Explained Without the Jargon

You might have encountered a website prompting, "Would you like to create a passkey?" It appears to be another password to manage, but in reality, it operates quite differently. When you create a passkey, your device or password manager generates a pair of cryptographic keys: a public key, which the website retains, and a private key, safeguarded by your authenticator.

During sign-in, the website transmits a challenge, which your authenticator responds to by signing with the private key. The website then verifies the response using the public key. Usually, you confirm this process using your fingerprint, facial recognition, or device PIN. No password needs to be typed or sent to the website.

What makes passkeys more resistant to phishing is their association with the specific service they were generated for. Unlike passwords, passkeys cannot be used on fraudulent websites that mimic the legitimate one. This binding technique inherently safeguards against phishing attempts. Additionally, sensitive biometric data like your fingerprint or facial recognition remains on your device; only cryptographic proof is shared with the website.

However, what happens if you lose your phone? It depends on how you stored the passkey. Some passkeys can be synchronized across multiple devices through a credential provider, while others remain tied to a specific device or hardware security key. Before committing to a particular passkey, it's essential to understand how your provider handles recovery and whether you can register an alternative authenticator. FIDO offers guidance on these matters.

For developers planning to implement passkeys, it's crucial to consider account recovery. A robust sign-in method alone won't suffice if the recovery process is vulnerable to attack. Utilize a reliable WebAuthn library, meticulously validate authentication responses on the server, and test scenarios where users might lose access to their devices. Google suggests relying on an established library rather than creating your own server-side registration process.

While passkeys can't prevent every type of scam, they effectively eliminate the common issue of users disclosing reusable passwords to malicious actors who trick them into providing these credentials. Have you begun using passkeys, or does the recovery process still give you pause?