In the world of usernames, passwords, multi-factor authentication, biometrics, and all the rest that makes up the bitter stew of account logins comes the new kid on the block: Passkeys. Passkeys have been sold as the solution to the complexities of usernames and passwords, but I am here to tell you right now that they do none of that, but only add to the confusion and mess of it all.
What are Passkeys? In the olden days, or before Passkeys... or right now, actually... websites, apps, and the like required a username and password combination for access. This combo was kept at the company that runs the website/app, and if and when their database was breached, both were stolen. The hackers then had full access to those accounts, since they had the two pieces to get in.
With Passkeys there is a Public Key and a Private Key. The Public Key is held at the website/app and the Private Key is held by you. The Private Key is secured by biometrics (FaceID or TouchID) or your device/computer password. It is incredibly complex and near impossible to recreate. The Public Key has no information in it that could be used to re-create your Private Key. This means that if the Public Key is hacked, it's worthless.
But Passwords are Still Here It sounds good, secure, and a whole lot easier than passwords, and in a world where Passkeys replaced passwords, that would be true, but they do not. You still need a username/password to create any account, and this combo is just as vulnerable as before. Passkeys do not resolve you of good password management. They are just another way to log in, and this adds complexity, which is always bad. Plus, many Passkeys still require you to go through multi-factor authentication.
Should You Use Passkeys? Since Passkeys do not replace the old username/password combo, it just adds something else for you to manage. We have also seen where a broken Passkey can lock a user out of an account, even though they still have the old password way of logging in. Implementation has been poor. If you want to play around with Passkeys, use them in non-critical accounts and create the key in the Apple Passwords app.
At the end of the day, Passkeys do more to protect the tech companies than they do to add much for the consumer at this point. If they are able to deploy Passkeys in the future to replace usernames and passwords, then they would be worth it. But right now it is all just additional noise in the increasingly cluttered world of technology. |