The use of passwords for authentication as a ways to login to various accounts and services on the internet has always been susceptible to cyber theft . Not only do users reuse their passwords but sophisticated “phishing” scams can coax many users to give up their credentials to cyber gangs. Improved security measures have been implemented such as the use of complex passwords and 2-factor authentication but these too are prone to cyber theft.
The Fast IDentity Online (FIDO) Alliance was created to solve issues related to online authentication through the use of interoperable standards using passwordless logins. FIDO standards have evolved to FIDO2 is supported by a variety of devices/operating systems and enabling the transition to passkeys. Some metrics from the FIDO Alliance website is shown below.
WHY FIDO? THE PASSWORD PROBLEM
WHY FIDO? THE BENEFITS ARE CLEAR
Passwordless authentication can verify user identity through the use of biometrics (e.g. fingerprint, face scan, phone screen locks), single-use passcodes, owner-based authentication (devices that are “verified”) and other means to avoid the use of passwords altogether.
Passkeys replaces the use of passwords and other forms of authentication like two-factor authentication. At present, Passkeys are moving more mainstream as major web platforms like Google (Android), Apple (iOS & MacOS), Microsoft (Windows) and major web browsers now support FIDO2 (Edge, Chrome, Safari, Mozilla, Firefox, etc.). As more web services transition to FIDO2, the adoption of Passkeys will be accelerating to the benefit of users.
THE DEVIL IS IN THE DETAILS
Passkeys use asymmetric encryption where a device generates a cryptographic key pair for each web service. A public key is shared and stored by the service and a private key stored on the device. The internet service will verify the authenticity of user by initiating a challenge/response. The public key encrypts the challenge and the private key can only decrypt the challenge and then sends the proper response to gain access to the service. The private key is never compromised as it never leaves the device. See image below from Medium: No More Passwords? The Truth About Passkeys Explained by Paritosh..
WHAT ARE PASSKEYS? (Rakuten Group Official)
HOW TO SETUP AND USE A PASSKEY (Step-by-Step Guide)
55+ Tech Chat and Social Group 