Beyond Passwords

  • •7 min read

In a previous post, I went over how to store passwords safely, and in another I looked at magic links as a way to avoid passwords altogether. Both had the same underlying problem. Passwords are a weak way to prove who you are. Yet we still use them almost everywhere.

The newest attempt to replace them is called passkeys, and they're a lot better than I expected.

What's wrong with passwords? #

The problem is that a password is a shared secret. You know it and the website knows it, which creates a few weaknesses:

  • People reuse them so one breach can unlock many accounts.
  • They can be guessed or cracked from a leaked database.
  • They can be phished. If you type your password into a fake site, the attacker has it.

Magic links get rid of the password but they move the problem to your email account. If someone has access to your inbox, they have access to everything.

How passkeys work #

A passkey replaces the shared secret with a pair of cryptographic keys. When you create one for a website, your device generates a private key and a public key. The website only gets the public key and the private key never leaves your device.

When you log in, the website sends a random challenge. Your device signs it with the private key and sends it back. The website checks the signature using the public key and lets you in. To approve the signing on your device, you would use a fingerprint, face scan or PIN but this only unlocks the key on your device and is never sent to the website.

Passkeys are built on the WebAuthn standard, which is part of FIDO2.

Why this is better #

There are two big improvements. First, there's nothing valuable on the server. If a website is breached then the attacker only gets public keys and those are useless for logging in. Second, passkeys are tied to the website they were created for. So your device won't use them on a fake site. That makes them resistant to phishing which passwords can't be.

So why hasn't everything switched? #

Apple, Google, Microsoft and GitHub all support passkeys now but passwords are still everywhere. I think there are a few reasons:

  • Recovery: if you lose your device, how do you get back in? Many services fall back to email or a password reset which brings the weakness back. An attacker can just go for the fallback.
  • Syncing: passkeys are usually stored by the platform such as iCloud Keychain or Google Password Manager. Moving between ecosystems isn't always smooth although password managers are starting to support them.
  • The long tail: a lot of websites and older systems haven't added support and they're not in a hurry to unless they have to.
  • Understanding: people are used to passwords. "Log in with your face" is a big change and many people aren't sure what it means or whether it's safe. Besides, would you want to give away your privacy to a company that you don't trust?

Final thoughts #

Passkeys fix real problems and I think they're the best option we have so far. But as long as a password can still be used as a fallback, an account is only as safe as that fallback. Until services are willing to remove passwords completely, I don't think they're going anywhere.