What is your favorite pet's name? What is your mother's maiden name? Sounds familiar? These are some security questions for password recovery that you may have encountered when trying to recover an account after forgetting your password.
Features like Google Password Manager save and autofill passwords for any website or application on your device, so you don't have to recall them from memory, saving you mental effort.
Even better, the introduction of Passkeys replaces the use of passwords entirely, eliminating the need to remember long, complex passwords with different characters for multiple websites or applications.
In this article, we'll discuss what a passkey is and how it impacts online security.
What is a Passkey?
A Passkey is a digital credential stored online. It is an implementation of FIDO (Fast Identity Online) and WebAuthn standards, which are a set of Open, Standard Protocols intended to eliminate the use of passwords for authentication. In other words, FIDO promotes passwordless authentication for online applications or services.
One of the key solutions of FIDO is phishing-resistant. Passwordless authentication is phishing-resistant because it depends on public key cryptography (public-private key pairs). There are no passwords stored in a server; even if a system were breached, there’s no password for the attacker to retrieve.
A Passkey, defined in more technical terms, is a discoverable web authentication credential.
Discoverable: This means that a passkey contains the user's information, like the user ID, which it can use to authenticate a system without requiring credentials like username or password.
WebAuth API: This is a web standard that enables websites and applications to use public key cryptography for passwordless authentication.
Credentials: These are cryptographic key pairs. The private key is stored on the user's device, and the matching public key resides on the server and is used to verify signatures or authenticity.
Passkeys also combine Cryptography and Biometric Verification, whereby a person can be identified by their unique biological traits, e.g., finger, face, voice, etc. to create a secure authentication.
Why was passkey introduced?
Many websites use methods to protect clients' credentials through password authentication; for example, users are prompted to create strong passwords that are hard to guess and resilient against phishing, brute force, or dictionary attacks.
Users are also advised to follow certain rules to protect themselves, like having unique passwords for every platform they register on, enabling multi-factor authentication, avoiding using public WI-FI to log in to sensitive accounts, etc.
The introduction of passkey is to replace passwords, which has many weaknesses. For example, people tend to use the same passwords across different sites; sometimes, they are easy to guess, which makes it easier to gain access via attacks like brute-force or phishing.
How secure is it to use a Passkey?
Passkeys are not stored on servers like passwords, so credentials can’t be stolen or hacked. Here are some security benefits of passkeys including:
Phishing Resistance: Since the private key is stored on the users’ devices, access cannot be gained via phishing.
Public/Private Key Pair: Each passkey is uniquely generated, and isn’t reusable across sites or applications, which makes them strong.
MFA: Passkey supports MFA by combining cryptography and biometric verification using biological traits like face id, fingerprint, etc.

















