Are Passkeys Safer Than Passwords?

But are passkeys the knights in shining armor that will protect us from cybersecurity threats? Are we witnessing the end of digital drama?

Password security concerns

Digital passwords have been around for decades, and there have been continuous efforts to make them more secure. Whenever you sign up for an account and create a login, your password is encrypted in the service’s database using a hashing function like md5, which turns any password into a 32-character-long alphanumeric string.

After that, every time you log on, the same process happens, and the resulting hash is compared with what’s stored in the user’s database. If they match, you’re granted access. Unfortunately, this system is not bulletproof as hackers can bypass it through:

• Brute-Force attacks
• Dictionary attacks
• Phishing
• Rainbow table attacks
• Credential stuffing
• Social engineering
• Etc.

Introducing passkeys

Passkeys consist of linked cryptographic keys – one public and one private – where the first is logged virtually with a service and the latter stored on a device (authenticator), such as a smartphone or computer. The authentication guardianship is with the device, with it using a PIN, pattern, or biometric validation like a fingerprint.

A passkey is like how you would access a bank vault: the public key is the code you tap into the keypad, and the private is the physical key. Unlike with traditional passwords, you don’t have to worry about memorizing anything, and passkeys can’t be guessed. Even if hackers accessed your public key, it would be useless without the authenticator and the means to open it, meaning that passkeys render phishing attacks impossible.

Are passkeys really safe?

Currently, passkeys are the best and most reliable method of authentication and identity verification. However, like everything online, there are still concerns and risks. For example, if a hacker steals your session cookie, he can pose as you for as long as the session is active.

Having your authentication device stolen or losing it can also be serious if it falls into the hands of someone who can unlock it. If no additional authentication factor is set up, the cybercriminal can access your accounts.

Which platforms support passkeys?

While passkeys are slowly gaining traction, they’re still very new, and not many applications or services have adopted them yet. Nonetheless, support is growing, with some companies implementing them alongside passwords to further secure data and familiarize users with it. Companies that already support passkeys include:

• Adobe
• Amazon
• Google
• PayPal
• WhatsApp
• GitHub
• TikTok
• Cloudflare
• eBay
• Shop by Shopify

For an extensive list of apps, websites, and services that support passkeys, 1Password has developed an extensive and comprehensive directory.

Passwords vs passkeys

Passwords have been around for decades and are still the main authentication mechanism used across the internet. However, getting users to try something new and give up their old habits is always challenging, even if the new approach is more secure. Passwords are easy to guess and steal since most users practice poor password hygiene with short, duplicated passwords across accounts.

Passkeys have their drawbacks, too. They’re a more complex authentication method and only sync across platforms on the same operating system. In addition, only a few renowned services provide passkey support, which may require additional hardware and software. However, even with these shortcomings, passkeys are exceptionally more reliable and convenient. Users don’t need to keep track of multiple passwords or worry about phishing attempts and can log in much faster.

Are passwords going away?

Passkeys are starting to steal the show, but they’re not replacing passwords any time soon. Passkeys are one of the most reliable authentication methods available and are undoubtedly a step forward in cybersecurity. However, we recommend that users get familiarized with passkeys but continue to use their passwords. This is easy since most services still use passwords as an additional authentication method.

However, there is an issue that remains unresolved with passkeys, which is that they are bound to the operating system with which they were created. For example, if you create a passkey with an Android device, you won’t be able to log in using iOS.

Best password managers that support passkeys

At first, passkeys seemed likely to signal the end of password managers since all you need is a device like a smartphone to access accounts. However, password managers now allow users to store and synchronize passkeys, becoming responsible for the authentication process instead of a device.

RoboForm

Embracing passkeys as the future of authentication

Given the nature of passkeys, it’s logical that they provide a much more secure authentication method than passwords. The mental gymnastics required to remember numerous passwords can be too much, and passkeys are here to help. Thankfully, this means the end to weak combinations like ‘mike1988′, which hugely increases the chance of a security breach.

We still recommend that users take additional precautions by activating MFA for all accounts possible and combining this with single sign-on. Additionally, users should ensure that any passwords they use are strong and do a data breach scan to check for any security incidents.

Passkeys are starting to be accepted by companies and users, but it’s still early days. While passwords will remain the most commonly used authentication method for a while, passkeys provide a significantly more secure and easier way to log in, so it seems it’s only a question of time until they triumph.