Getting Started With Passkeys, One Service at a Time

• Major technology companies like Apple, Google, Microsoft, and third-party password providers such as 1Password and Bitwarden have embraced passkeys. This widespread adoption is in response to the recognition that passwords pose a significant security risk online.
• Passkeys are created as a secure and convenient alternative to passwords, utilizing encrypted hardware enclaves and biometric authentication available on modern devices like Windows systems, Macs, iPhones, and Android devices.
• Since passkeys are tied to specific devices, losing, damaging, or having the device stolen can result in losing access to accounts. Cloud infrastructures provided by Apple, Google, Microsoft, and third-party providers offer account recovery services.

This article by Robert Lemos discusses the growing momentum of passkeys, a technology designed to replace traditional passwords for logging into websites and cloud services. Major technology companies like Apple, Google, Microsoft, and third-party password providers such as 1Password and Bitwarden have embraced passkeys. This widespread adoption is in response to the recognition that passwords pose a significant security risk online. The FIDO Alliance, which powers the technical specifications for passkeys, estimates that over 7 billion accounts could use this technology, though most users have not yet adopted it.

Passkeys are created as a secure and convenient alternative to passwords, utilizing encrypted hardware enclaves and biometric authentication available on modern devices like Windows systems, Macs, iPhones, and Android devices. The passkey standard, established by Apple, Google, and Microsoft in collaboration with the FIDO Alliance, uses WebAuthn-compliant certificates for authentication. These passkeys are managed differently across various ecosystems, but all conform to the standardized format. Google reports that 60% of its users find passkeys easier to use than traditional login methods, although a significant adjustment period is still expected for widespread adoption.

The article outlines the practical steps for creating and managing passkeys across different platforms and services. For instance, Apple users might prefer iCloud Keychain for managing passkeys, while Google Chrome users can manage them via the browser’s password capabilities. Third-party services offer cross-platform passkey management through applications and browser extensions. Creating a passkey differs slightly between services and platforms like Google, Microsoft 365, and PayPal when used with 1Password for Apple.

Finally, Lemos addresses the critical issue of recovering from a lost device. Since passkeys are tied to specific devices, losing, damaging, or having the device stolen can result in losing access to accounts. Cloud infrastructures provided by Apple, Google, Microsoft, and third-party providers offer account recovery services. The article advises users to familiarize themselves with their chosen ecosystems’ recovery processes and consider using hardware tokens as a backup method for accessing accounts, ensuring they are prepared in case of a lost device.

Read the full article