the passkey system can present a QR code to scan.
Furthermore, this QR system is used for cross-platform integration. Say you were using an iPhone but needed to sign into an account on a Windows PC, you would simply type your username and then scan the QR code that shows up on the PC with your iPhone to sign in.
What issues do they solve?
This solution solves a plethora of problems associated with passwords. Firstly, this will help prevent traditional social engineering attacks, such as phishing, as you don’t know the passkey to be tricked into giving away. The system will know what account/website your passkey is linked to, eliminating spoof websites aiming to “phish” your passkey.
Even attacks like shoulder surfing (someone looking over your shoulder and learning your details) are prevented as no one can see what you are typing, as there is nothing to type, so nothing to be stolen. Having nothing to be stolen also addresses a big issue with leaked passwords ending up in data breaches.
Stealing a passkey looks to be a near impossible feat, even for the most capable of attackers.
Each passkey is unique for a single account, which stops the same password being used on different accounts. This eliminates the issue of an attacker gaining potential access to these multiple accounts through one passcode.
Are there any drawbacks?
As this solution is at the testing/early adoption stage, we can assume there will be drawbacks whilst refining passkeys. One example is if you were to lose your device that the passkey is attached to. How can you recover your passkey onto another device if this was to happen? As there would be no QR code for you to scan from your device.
Apple did introduce “recovery contact” in iOS 15 so that you can gain access to your Apple ID in the event of a lockout through a trusted, pre-established recovery contact. This will allow the trusted person to provide you with a recovery code to be passed back to you to gain access to your Apple ID. We can assume that more practical solutions for recovery will be revealed in the future as passkeys become more widely adopted and refined.
We cannot rule out the drawbacks associated with biometric authentication. Although rare, false acceptance rates are something to consider with biometrics. Apple claims that the likelihood of an unauthorised person gaining access to your device using Face ID is less than 1 in 1,000,000.
Furthermore, FIDO has a strong membership base, but there may be some issues with passkey adoption across all platforms at this current time. As the environment begins to gain traction, we can expect more vendors and platforms incorporating this standard within their systems.
Do we still need Two-Factor Authentication (2FA)?
So from what we know, passkeys do not make use of 2FA during the sign-in process. In a world where 2FA is strongly emphasised for password protection, can we really make do without using it on our accounts?
Well the argument could be made as nothing can be obtained, there is nothing to steal by attackers. So as there is nothing to bypass, a second layer of defence now becomes obsolete?
Apple answered this question, by stating that any Apple ID account using iCloud Keychain requires 2FA enabled in order for a user to register a new passkey. If this is not enabled, you will be prompted to set up 2FA. So although the individual passkeys themselves have no 2FA, the environment (your Apple ID account) they live within does. This may certainly be a way to ensure we still use a second layer of defence, but only when it is applicable.
Our thoughts:
To summarise, Passkeys look to be the solution we’ve been waiting for, as we’ve long known passwords were never made to scale. As it is still in that initial adoption stage, we can expect a lot more development over time to iron out any issues regarding adoption on a large scale.
Overall, we believe this solution has great promise in developing a password-less future. It certainly is great to see the juggernauts within this space join forces to tackle a security issue that has been prominent for way too long. Maybe the days of phishing and account lockouts are truly becoming numbered? Let’s wait and see.
Blog
This section provides an overview of the blog, showcasing a variety of articles, insights, and resources to inform and inspire readers.
-
What is a Strong Password?
Using information such as birthdays, your company’s name, sports teams etc. should be avoided as…
-
Third-Party Cyber Security: Why Due Diligence is an Awkward Necessity
In today’s digital landscape, the reliance on external third-party suppliers, freelancers and partnerships has become…
-
ISO 27001 – The gold standard of Cyber Security for Small Businesses?
I (Farzan speaking here) remember when I was first looking to break into cyber security…
Leave a Reply