SOLVED: Why Passkey Is Better Than Password & How Passkeys Work in Simple Terms – Up & Running Inc

We’ve all experienced the frustrations of passwords. They’re tough to remember, easily guessable, and when a major corporation suffers a data breach, your supposedly ‘secure’ password can end up for sale on the dark web. A few years ago, companies began mandating overly complicated 16-character passwords that we must change every few months. It’s time we put an end to this chaos.

The answer isn’t finding a better password but rather eliminating passwords altogether. Let’s welcome the Passkey!

What is a Passkey? (A Simple Breakdown)

A Passkey replaces your traditional password by using something you already possess for unlocking your devices: your face, fingerprint, or a simple PIN.

Importantly, it’s securely stored on YOUR device rather than on the website you’re trying to access.

Consider this: instead of using a familiar old key (your password) to unlock a door on the internet, your device holds a unique digital key for each website. When you attempt to log in, the website requests this key. Your device responds, “First, confirm it’s you,” by scanning your face or fingerprint. Once verified, the device opens the digital lock, and you’re in, eliminating the need for passwords.

Why Every Company is Shifting to Passkeys (The Business Rationale)

This isn’t merely a trendy innovation; it represents the future of online security, with businesses eager to adopt it for three compelling reasons: enhanced security, streamlined processes, and significant cost savings.

1. Phishing Resistance: This is the standout feature. Phishing occurs when a scammer sends a fraudulent link resembling your bank’s login page, tricking you into entering your password. Passkeys are resistant to such attacks; they are “cryptographically” linked to the specific website they were created for. If you encounter a fake site, your passkey won’t work, safeguarding your credentials.
2. Breach Resistance: Should a website be hacked, criminals would not gain access to stolen passwords but rather to a database of Public Keys (further explained ahead). These public keys hold no value to hackers, ensuring your login details remain secure even during data breaches.
3. Reduced Friction and Costs: A significant expense for businesses is customer support for password resets. Lost or locked-out users require time and money to assist.
   • Years ago, we discussed “friction” in business classes, and Amazon exemplified its importance. Any friction in a transaction diminishes the chances of a sale. Passkeys eliminate much of this “authentication friction” by relying on the simple act of unlocking your device. This enhances login success rates and drastically lowers support costs, making the process FASTER and EASIER, benefiting both users and businesses.

Revolutionising Authentication (The Technical Side)

Understanding Passkeys involves recognising how they radically change our approach to authentication, a system that has remained largely unchanged for three decades.

The Old, Inefficient Model

In the old system (passwords), the Server stores a hash of your secret password. This means the Server holds the crucial secret, and if it’s breached, that secret is exposed. In security, we call this a “shared secret” (essentially, you’ve shared your password with the website).

The New, Secure Approach

Passkeys employ Asymmetric Cryptography (or Public-Key Cryptography), which is where the innovation unfolds.

1. Key Pair Creation: When you set up a passkey on a site, your device (be it a phone or laptop) generates a pair of unique, mathematically linked cryptographic keys:
   • The Private Key (The Passkey): This is the actual secret, never shared with the website. It is safeguarded on YOUR device, within a secure hardware chip known as a Secure Enclave (on Apple devices) or a Trusted Platform Module (TPM) found in Windows 11 and Android devices. Extraction is impossible.
   • The Public Key: This key is submitted to the online service and stored on their servers, linked to your account. It is safe to distribute, as it can only be used for verification, not creation.
2. The Authentication Procedure: When you wish to log in:
   • The web service transmits a random, one-time data challenge to your device.
   • Your device uses your fingerprint, face, or PIN to unlock and access the Private Key.
   • The Private Key then cryptographically signs the challenge, generating a unique signature.
   • The signature is sent back to the Server.
   • The Server employs your stored Public Key to verify that the signature is valid.

The crucial aspect here is “domain binding.” If a hacker obtains your Public Key from a genuine site (like www.real-bank.com or www.Google.com) and tries to lure you to a counterfeit site, the attack will fail instantly. This is because your device—holding the Private Key—checks the website’s domain (evil-clonesite.com) against the domain the passkey is tied to (yourbank.com). If they don’t align, your device denies access to the Private Key, preventing authentication. Hence, a stolen Public Key is rendered ineffective on the fraud site, making passkeys inherently phishing-resistant and thwarting such attacks at the outset.

Challenges with Passkeys

Despite their greatly enhanced security, passkeys present significant hurdles that need to be overcome for wide acceptance. The main concerns include device dependence and potential vendor lock-in: if you lose or damage the device containing your primary Private Key (for instance, if you buy a new computer or break your phone), recovering your account can become exceedingly difficult. Migrating your synced keys across different platforms (like moving from an Apple iCloud Keychain to a Google Password Manager) is often currently unfeasible.

Moreover, not every website and application yet supports this technology, leaving users to continue relying on traditional passwords. The reliance on modern device hardware creates a gap, leaving users with older or shared computers still grappling with the shortcomings of passwords.

These challenges are being addressed. Key players, including Apple, Google, Microsoft, along with cross-platform password managers like 1Password, Dashlane, and Bitwarden, are collaborating within the FIDO Alliance to establish new standards for credential exchange.

Conclusion

Your private key, the true secret, NEVER LEAVES YOUR DEVICE. The Server only retains the public, non-secret key. This marks a profound shift: the security secret is now exclusively stored on the consumer’s device rather than residing on a vulnerable web Server. Consequently, even in the event of a Server breach, hackers gain nothing of use, maintaining your account’s security. This monumental transition in online security means you should adopt passkeys as soon as they become available on the sites you use.