First — What is a passkey? This is a device specific authorization that uses the device authentication (i.e., pin, fingerprint, face scan, etc…) to allow access to a program/website. Think of it as a special authentication that is limited to a physical piece of hardware in your hands. There is no need for 2-factor authentication or passwords if the program/website is using a passkey.
Concern — How is that better, and what happens if that device is lost, stolen, or has a critical malfunction? Passkeys are better in 2 ways!
- From the end user standpoint, a single passkey can safely access multiple different applications. This is very helpful for the human brain. The reason a password should not be used this way is because passwords are transmitted over the internet to the program/website. Passkeys are not. The only information transmitted is the approval status….not the actual passkey code!
- If the device becomes unusable (lost, stolen, critical failure, etc…), how do I log in? First, remember that passkey technology normally is managed by a 3rd party using extensive encryption technology specially for retrieval when device changes/reformatting occurs. Assuming you are using something like Google Password Manager, iCloud Keychain, Microsoft Authenticator app, etc…, you can recreate a new passkey when your device is repaired or replaced that will have access to all the original content. Secondly, most websites/programs that use a passkey still have backup methods for access if passkeys are failing. Third, a passkey can be saved as a physical security key (special kind of USB stick). This makes the stick the authentication device so you can use it with any computer.
But what about when someone has access to my computer or laptop? First, if you are not physically present at your device, it should be locked. You should also have a timer set to automatically lock it after X minutes to ensure this happens just encase you forget to lock it when you step away. If a thief was going to get access, they would have to steal it when it was unlocked and use it before the timeout feature would protect your data. Assuming that they have access with it locked, the types of thieves that can break operating system security in a passcode are not the local kind. They are typically government backed actors, that most of us don’t need to consider.
What about if I need more than ONE passkey or profile? For example, my work has me use my personal laptop.
- Typical passkey systems allow more than one to be created.
- If you think you require more than one, talk to a geek! Just because you use multiple programs/website does NOT mean you require multiple passkeys. Your IT support (or me) can help you navigate this concern.
Some USB stick based security key options:
- Theitis Pro FIDO2 Security Key — https://a.co/d/98RaqCo
- GoTrus Idem Key — https://a.co/d/7TmpgAv
- USB Fingerprint Reader — https://a.co/d/c1IoFBH
- Yubico Bio USB-C Key — https://a.co/d/3EvjfG0