Passkeys – der Schlüssel zu einer passwortlosen Zukunft

Passkeys – the key to a password-free future

Have passwords, password managers and multi-factor authentication become things of the past? It seems so. Providers such as Google and Apple are already using passkeys. But how does this new login method work, and how secure is it really?

With passkeys, you will in future be able to log in to various online services without needing to enter your password. Instead, you will authenticate yourself via your smartphone or tablet using a PIN, a master password, facial recognition or a fingerprint. Not only is this faster and more convenient; it is also more secure than traditional login processes. Passkey technology has been developed by Google and the FIDO Alliance (FIDO = Fast Identity Online) – which also counts companies such as Microsoft, Apple and Amazon among its members.

How do passkeys work?

A passkey consists of two different keys, which work together to enable you to log in. The public key is stored in the online service you are using – whether a website or an app – while the second, private key is stored on your smartphone or tablet. This second key is an asymmetric crypto-key, which consists of a very long, randomly generated sequence of characters. Nobody – not even you – knows what this key is made up of.

It sounds complicated, but it’s practical and easy to use in everyday life, because the technology does almost everything for you. The online service doesn’t ask for your data, but instead asks your device to confirm its request. The process is similar to the authentication process used in e-banking.

What makes passkeys so secure?

Passkeys eliminate the risk of phishing and other cyberattacks by reversing the traditional authentication process. The trick is that the connected device generates a new password for every login. This makes it impossible for hackers to steal your password because it will be invalid at the next login attempt. If you authenticate yourself using facial recognition or a fingerprint, and without a PIN or master password, nobody else can log in using passkeys in your name.

Passkeys in review

There’s no shortage of hype about passkeys from experts. But every technology has its advantages and disadvantages. Here is a brief summary:

Advantages

  • You no longer have to come up with creative passwords, memorise them and enter them manually.
  • No more time-consuming two-factor authentication.
  • Nobody can steal your password because you no longer have a password known to you.
  • Access is more secure than with any other system used to date, and hackers are locked out.

Disadvantages

  • You can only access your accounts with your own verified device.
  • If your biometric identification (e.g. facial recognition) is compromised, you will not be able to log in if you have selected this authentication.
  • You can no longer share an account, such as Netflix or Amazon Prime, with others.
  • If you are threatened, it is possible to gain access quickly using facial recognition or a fingerprint.

Where can I use passkeys already?

Some major tech companies already rely on passkeys. For example, the system is integrated into Apple’s iCloud Keychain and the Google Account. You can find out how to activate them with Apple, Google and Microsoft in the linked step-by-step instructions from the providers. Also see the Passkeys directory for an alphabetical list of other services that already support passkeys.

Useful links

Already use passkeys? Share your experiences with the Community!

Show original language (German)
Illustration image of a woman with a laptop

I already use passkeys for a few services and think it’s great. By integrating it into my password manager of choice (1Password), I can use the passkeys on all my devices as long as I know my 32-digit master password 🙂

I hope that Swisscom will also introduce this in Kundencenter. That would simplify a lot of things. SMS is very outdated and MobileID is limited to 1 device.

Show original language (German)
25 days later

@Felix30

Many providers usually provide an alternative option, e.g. via email or entering a password via a login window.

Show original language (German)

Installationen, Netzwerk, Internet, Computertechnik, OS Windows, Apple und Linux.

If there was a single provider it would be good. But Google has one and many others, so ultimately you have to have many such apps on your cell phone. And when you can no longer log in, the trouble really begins and you have to wait for days until it works again. So it’s absolute nonsense, the good old password is still the best. Unfortunately I also have to use this nonsense for three logins and have to use three different key apps for them🤣

Show original language (German)

Hi @Mionninnie57

Yikes - you’re on an interesting course

.Uniform providers are never the solution - that only leads to a monopoly. The motto must be: open standards. And this is WebAuthn.

So you probably either don’t use a passkey, but rather some proprietary solutions, or you have unnecessarily installed 3 apps for the same technology 😉

LG

r00t

Show original language (German)

4b 65 69 6e 65 20 4d 61 63 68 74 20 64 65 72 20 6c 65 67 61 63 79 20 49 50 21

@Mionninnie57

Unfortunately, passwords are no longer secure in today’s Internet service. 😕

Face recognition is also a good service and is already used several times today.

Show original language (German)

Installationen, Netzwerk, Internet, Computertechnik, OS Windows, Apple und Linux.

Why should passwords no longer be secure? When I’m not posting these on Instagram, they’re still safe and I’ve never had any problems. But if your mobile phone breaks or is lost, then the trouble begins with how to get access again, because the apps usually depend on the registered mobile phone, so it is an absolutely useless technology. At banks you wait from 2 to several days. Or calls to the provider, changing phone numbers is no longer so easy, etc. If you want to make your life even more difficult, then this immature junk is exactly the right way.

Show original language (German)

Hi @Mionninnie57

Sorry, I have to jump in again:

I’ve never had any problems

I’ve never had a car stolen - I don’t understand why we spend so much money on the police

As someone who is close to the password cracking industry (only to the extent allowed, of course), I can tell you that the reality is very different. Passwords are the internet user’s natural enemy. Because to really take it seriously, every page has a completely randomly generated, long password.

Nobody can remember that - that’s why password managers exist.

And if you already have a password manager, you can store a private key instead of a password. Using the challenge-response procedure, you no longer have to transmit it etc. etc. etc: (Excerpt from Wikipedia🙂

  • As the private part of a credential is automatically generated using a sane algorithm with sane parameters and randomness, and stored in a trusted authenticator, the following issues disappear:
  • Easily bruteforceable passwords due to insufficient length.
  • Easily guessable passwords by dictionary attacks (e.g., “password”, “12345678”, etc.).
  • Easily guessable passwords by social engineering (e.g., date of birth, home address, etc.).
  • Inadequate password storage on the client side (e.g., written on a post-it note, in a book, in the mobile phone contact list, etc.).
  • Password reusal for different websites, as different credentials are automatically created for different websites.
  • The need for servers to enforce minimum criteria for passwords while not limiting usability.
  • Servers setting arbitrary and inadequate restrictions on the maximum length of passwords and the allowed charset.
  • As the private part of a credential is never stored on a database on a server, the following issues disappear:
  • Inadequate password storage in databases (e.g., plaintext, or using weak or insecure algorithms or constructions).
  • Potential databases leaks exposing passwords.
  • As credentials are different for every website, the following issues disappear:
  • Credential stuffing attacks that combine database leaks with the common practice of reusing passwords for multiple websites.
  • Phishing attacks, as the user verification process never involves credentials for the wrong website.

Personally, I use passkeys wherever possible - with my password manager these are also available on all devices. If you have a problem with access when even one device is down, then it is due to your security concept - not due to “immature” technology.

If you forget a password, it’s not the password’s fault 😉

LG

r00t

Show original language (German)

4b 65 69 6e 65 20 4d 61 63 68 74 20 64 65 72 20 6c 65 67 61 63 79 20 49 50 21

Yes, Keepass database in Cloud A, an additional key file in Cloud B or locally on the corresponding device. I’ve been living with this solution for several years without any problems…

Show original language (German)

….keep on rockin'

a month later