Passkeys

[Tringa]

I've heard quite a bit about how passkeys are going to provide better online security than using passwords to access various things online.

If I have understood correctly a passkey is in two parts. One part is on the server you are trying to access the other is on your device. Together they appear to provide access to secure servers without you having to input a password.

I've seen Q&A about passkeys and one question is, "what happens if my device is stolen." All the answers I have seen are in terms of how you will still be able to access the services you want by syncing you passkey to other devices, but I haven't see anything about what the person who stole your device can do.

If, when a device is passkey enabled, no password is needed to access servers won't a thief have free range to access you bank and credit card accounts and other places where normally a password would be needed.

What have I missed?

Dave

 

[AndrewFlannigan]

Passkeys rely on your personal device's security.

If your device uses a hard to crack login, such as facial recognition, then the system is, at the moment, more secure than passwords. However, if you use a password to access your device and the thief can crack that, you may well be in trouble because, once the thief has control of your device, they are more than likely to have access to anything protected by a passkey held on that device.

Like most security protocols, passkeys rely on you keeping bad guys out of your pocket.

 

[Nod]

My old phone's facial recognition was a joke. It sometimes failed to recognise me at all but would sometimes recognise me when I was wearing sunglasses.