Passkeys - Your Gateway to Seamless Security

Cybersecurity

In the digital world, passwords are like the keys to your personal treasure chest, but let’s face it, they’re more like a bunch of sticky notes you can’t find when you need them but someone else somehow can. Can we eliminate passwords by some degree? Yes, with Passkeys.

Passkey is a type of authentication method used to secure access to various online services and accounts. It is a unique key pair consisting of a public key and a private key that is generated specifically for an individual user

… in short, use your phone or fingerprint device with biometric to authenticate your login.

Before adopting Passkeys you can have a trial on https://www.passkeys.io/. Remember to read instructions from https://www.passkeys.io/#How-to-use-a-passkey. You can create a passkey on multiple devices for the same account.

How Passkey works for dummies

Below demo runs on a Windows with fingerprint sensor and Windows Hello. You can have the same experience on mobile.

Creating an account on website

Like many applications, you need to create an account first. Most websites would ask you for a password setup to keep you comfortable.

Create an account with email you like,

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create1.png class=“border”>

Registration is skipped as this is just a demo

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create2.png class=“border”>

Create first passkey

Once you click the create button, the website would ask your browser to setup passkey.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create3.png class=“border”>

Your browser directs your request to a module which has passkey capability. Bitwarden in this case.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create4.png class=“border”>

Authenticate with biometric.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create5.png class=“border”>

Create a public/private key pair. Private key stays in the module. Only public key send back to browser and the website.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create6.png class=“border”>

That’s it! The website associates your account with your passkey. You can logout/sign out.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create8.png class=“border”>

Login

Login is very similar to creating an account. Sign in with a passkey. You don’t need to provide your email address.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/login1.png class=“border”>

The process is the same.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/login2.png class=“border”>

You may notice that you can use more than one device to login.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create9.png class=“border”>

Setting up second passkey for your account

Let’s try “Use another device”

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create10.png class=“border”>

“iPhone, iPad, or Android device”

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create11.png class=“border”>

Scan QR code from your device.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create12.png class=“border”>

Your device tells the website that the QR code is scanned from your account.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create13.png class=“border”>

After authentication, your device generates its own public/private key pair, and then sends the public key to the website.

<img src=/_post_images/2023/12/passkeys-your-gateway-to-seamless-security/create14.png class=“border”>

You can now use the second passkey to login!

What if my mobile device is lost

Remember to setup recovery method for your account! Second passkey can be a recovery but please pick a reliable one to yourself. Otherwise you will end up like below.

Where can I use passkey

The following list will assist you in identifying services that are compatible with passkey adoption.

Services/OS that support Passkey:

  • Bitwarden
  • Windows (Windows Hello)
  • iOS
  • Android

Websites/Apps that support Passkey:

Websites that do not yet support Passkey but support Multi-Factor Authentication (MFA):

You are encouraged to adopt Passkeys for enhanced security, as they are not susceptible to traditional phishing attacks and do not require memorizing complex passwords.

With the support of industry giants and the convenience they offer, Passkeys are set to become the new standard in digital security.

Comments

Please accept the "Functionality" cookie category to view and post comments.