Why Passkeys Are Replacing Passwords

by Sharon McDowell, MMBB Business Liaison, Technical Trainer

What you'll find in this article:

• What are Passwords?
• What are Passkeys?
• Security Benefits of Passkeys 
• Passkeys Aren’t Perfect

Last week, Jenna tried to log into her old photo storage account to find a picture from a family trip. She typed in what she thought was the right password, but no luck. She tried another. Then another. After five failed attempts and a reset link later, she finally accessed her account. That’s when it hit her; she had a different password for everything -- email, banking, streaming, shopping, work apps, even her dog’s vet portal. 

When she checked her password manager, it listed 137 saved logins. Jenna laughed and said, “No wonder I can never remember any of them. I have more passwords than I do socks!”

Time to Rethink the Way We Log In

For decades, passwords have been the gatekeepers of our digital lives, yet they’re also the weakest link. From forgotten credentials to phishing attacks and data breaches, the traditional password system is showing its age. Enter passkeys center stage: a more secure and user-friendly way to authenticate that promises to eliminate the hassle and vulnerabilities of passwords altogether. As tech giants embrace this shift, the question isn’t if passkeys will replace passwords; it’s when.

What are Passwords?

Passwords are words, phrases, or strings of characters used alongside a username to verify identity when accessing online resources. The first online password was used at MIT in 1960. Two years later in 1962, the first theft of an online password occurred and by 2009, password hacking was common. 
Today, even though over 90 percent of people are aware of the security risks of reusing passwords, 65 percent still do it. In fact, the average person uses the same password across fourteen different accounts.¹  The reason many adults take the risk of getting hacked is password fatigue, the frustration of trying to remember and manage numerous different passwords.

In addition to reusing passwords, other issues include weak passwords, phishing, and data breaches. A password manager, software designed to generate, store, and autofill strong passwords, offers a partial fix but it has limitations. 

Meet Passkeys

Passkeys are a passwordless authentication method that uses cryptographic key pairs to securely log you into websites and apps. Instead of typing a password, you authenticate with a device such as your phone or computer. They’re easy to use without the need to memorize anything. 

The authenticator still requires user verification, which can be a PIN, password or biometric. Biometrics, which are optional, include:

• Fingerprint recognition (e.g., Touch ID on iOS, fingerprint sensors on Android and laptops)
• Facial recognition (e.g., Face ID on iOS, Windows Hello Face Unlock) 
  Other device-supported biometrics (such as iris scanning on some devices)
• Passkeys can sync across devices when stored in a password manager or remain device-bound when stored in hardware. 

Passkeys can sync across devices when stored in a password manager or remain device-bound when stored in hardware.

Security Benefits of Passkeys 

When you create a passkey, your device generates a pair of cryptographic keys: 

• a public key, stored on the service’s server. 
• a private key, kept securely on your device. 

Private information doesn’t need to be stored on the server, only the passkey is stored. 

Passkeys Aren’t Perfect

Passkeys are highly resistant to hacking but no system is infallible. They depend on the security of your device. For example, if malware compromises your device, your passkey may be at risk. 

Backup solutions and recovery steps are essential in case you lose, break or replace your device. Passkeys can be backed up in the cloud or stored in a password manager.  Other drawbacks to consider include:

• Limited Adoption. Not all websites, services and industries support passkeys yet, forcing users to rely on hybrid systems.
• Learning Curve. Users accustomed to passwords may find the transition unfamiliar or confusing at first.
• Privacy Considerations. Biometric authentication (fingerprint/face) may raise privacy concerns for some users, despite data being stored locally.
• Edge Case Security Concerns. Some uncertainty remains about how synced passkeys are stored by platform providers and what happens if that sync system is compromised.²

Jenna’s struggle isn’t unique. It’s the reality for millions of people juggling countless passwords every day. While password managers offer some relief, they’re not a perfect solution. Passkeys represent the next evolution in digital security: simpler, stronger, and far less vulnerable to the risks that plague traditional passwords.

Tech experts believe the mainstream transition to passkeys may be a long or gradual one like the shift from magnetic swipe cards to chip cards.  As technology moves forward, embracing passkeys won’t be just about convenience. It will be about safeguarding our digital lives.

Sharon McDowell serves as the business liaison and technical trainer at MMBB. She joined MMBB’s staff in 1992 and served on MMBB’s Help Desk team as a network analyst for more than 15 years. She is currently responsible for coordinating MMBB’s ongoing cybersecurity training. Her education includes a BS in computer science from State University of New York, College at New Paltz.

Sources

https://biztechmagazine.com/article/2023/02/password-fatigue-real-heres-what-businesses-need-know¹

Should You Use Passkeys Instead of Passwords? - Consumer Reports²