The technology, best practices and standards behind password security continues to evolve to keep pace with the cyber threat landscape. One of our best practices is that all our clients use a Password Manager. This improves security and saves everyone time. The latest development in password management are passkeys - a modern authentication method designed to replace passwords with a more secure, user-friendly alternative. While passkeys are currently not available for every application, they are part of a broader movement that replaces passwords and traditional multi-factor authentication (MFA) methods, like SMS codes in favour of more secure and easier-to-use solutions. In this blog post, we will explain what passkeys are, how they work and the key differences between passkeys and passwords.
What Are Passkeys?
Passkeys use cryptographic key pairs (public and private keys) to authenticate users. They are designed to be resistant to phishing attacks and easier to use than passwords, especially for those that struggle with complex password management. The main advantage of passkeys is that they rely on your device to manage your identity, rather than asking you to remember or manually enter a password.
How Passkeys Work
Every passkey consists of two interlocking parts: a public key that’s shared with the website or app you want to sign in to, and a private key that never leaves your devices. It's impossible to reverse-engineer one key from the other, which is what makes passkeys resistant to phishing attacks. No one can log in to your passkey-protected accounts without access to your passkeys (and a way to authorize the device that stores them). That means passkeys you choose to share stay safe with those you trust.
1. Key Pair: A passkey consists of two keys — a public key (which is stored on the server) and a private key (which is stored on your device).
2. Authentication: When you attempt to log in to a service that supports passkeys, your device uses the private key to prove that it knows the correct credentials without transmitting the private key itself. The server verifies your identity using the public key.
3. No Password: This system completely eliminates the need to remember or enter passwords, and since there's no password to steal or phish, the system is much more secure.
Passkeys vs. Passwords
Passkeys are easier to use than passwords because there's nothing to memorize, type out, or copy and paste in. Instead, you sign in to accounts with a biometric scan or device PIN. Unlike passwords, you don’t have to come up with anything or take the time making it complex.
Passkeys at 1Password
We’ve partnered with 1Password to provide our clients with password management. 1password has now incorporated passkeys as part of its offering to improve security and convenience for its users. You can discover where you can start using passkeys by simply logging into 1Password. Open your vaults, select Watchtower and you will see a list of existing accounts that can be secured with a passkey. Here's how passkeys are used with 1Password:
Storing Passkeys: 1Password can securely store your passkeys alongside other login credentials. It manages the private keys and ensures they are properly synced across your devices.
Filling Passkeys: 1Password will autofill passkey-based logins in apps or websites that support this technology. It seamlessly integrates with your devices' biometric authentication (Face ID, Touch ID) or device PIN to provide secure access without requiring you to manually enter credentials.
Cross-Device Sync: 1Password's cloud syncing means that if you set up a passkey on one device, it can be securely synced to your other devices, making it easy to access accounts across your different devices without compromising security.
No Passwords to Remember: Since passkeys eliminate the need for traditional passwords, users no longer need to worry about password complexity, reuse, or forgetting them. 1Password handles this entirely, providing a seamless experience.
Benefits of Passkeys in 1Password:
Passkeys are helping users make the transition away from passwords, which are often vulnerable to breaches, phishing, and human error. 1Password’s adoption of passkeys encourages a more secure and streamlined experience for managing and authenticating logins. If you need help improving your security posture or would like to learn more about password management, please contact us.