Passwords are one of the most commonly used methods for protecting online accounts, but they can be easily compromised. They can be guessed, reused, stolen through phishing, or obtained as a result of security breaches. The Cybersecurity Agency warns that an alternative is digital access keys (passkeys), which allow authentication without entering a password and provide enhanced protection.
What are digital access keys?
A digital access key, known as a passkey, is a unique authentication method associated with a specific account and a specific online service. Unlike a password, this is not a text that the user needs to memorize or enter at each login.
When a passkey is created, the device generates a pair of cryptographic keys that work together. The private key is securely stored on the device or in a secure system that allows synchronization between multiple devices, while the public key is registered by the online service. The private key is not transmitted to the service.
Thus, the server should not store a password or any other authentication secret that could be stolen in the event of a security breach.
For the user, the process is simple. Instead of entering a password, they confirm access using the device’s unlock method, for example fingerprint, facial recognition, or a PIN.
How does it work?
When the user tries to log in, the online service sends a unique request to the device. The device uses the private key to generate a cryptographic proof, and the service verifies this proof with the help of the public key it holds.
The entire process takes place without the private key being transmitted to the server and without the user entering a password.
An essential element is the fact that the passkey is associated with the service and domain for which it was created. For this reason, a fake site mimicking a legitimate service cannot use the same key for authentication. Even if the user lands on a phishing page, there is no password to enter and give to the attacker.
This feature makes passkeys considered resistant to phishing and represents one of the main advantages over traditional authentication methods.
Furthermore, when authentication is done through fingerprint or facial recognition, biometric data are verified locally on the device. The online service does not receive the user’s face image or fingerprint.
Passkeys can be synchronized between devices through secure credential management services, which store and protect the data needed to access accounts. This allows the user to access their accounts even when changing their phone or using a different device.
There are also passkeys that remain associated with a single device or a hardware security key. These are especially used in situations where a higher level of control over the way the authentication method is stored is necessary.
What are the challenges from a cybersecurity perspective?
Although passkeys offer better protection against password theft and phishing attacks, they do not eliminate all security risks.
One of the main challenges is protecting the device. If a person gains access to a phone or computer and manages to unlock it, there may be a risk of access to the associated accounts.
Another important aspect is account recovery. The loss of a device or access to a passkey should not mean the definitive loss of the account. Services usually offer alternative recovery methods, but these, in turn, must be properly protected. A poorly secured recovery procedure can become the vulnerable point of the entire authentication system.
There is also a difference between synchronized passkeys and those tied to a single device. The synchronized ones are easier to recover and use on multiple devices, while those associated with a single device provide stricter control over where the authentication method is stored.
The use of passkeys therefore does not mean that users can abandon other protective measures. Attackers can still try to compromise the device, gain access to the recovery account, or convince the victim to install malicious software.
How should they be used correctly?
To benefit from the protection offered by digital access keys, the Cybersecurity Agency recommends using them in conjunction with basic security measures.
Users are encouraged to create passkeys only from the official application or from the official service website and to avoid accessing unsolicited links received via email, SMS or social networks.
The phone and computer must be protected with a PIN or a secure password, and security updates must be installed on time. The device’s PIN and password should not be disclosed to other people.
Just as important is that the account recovery methods be properly secured. In case the service provides recovery codes, these must be kept in a safe place.
For important accounts, specialists also recommend having a backup access method, such as a passkey available on another device or a physical security key, like YubiKey.
It is also recommended to periodically check the devices and access keys associated with the accounts. Access from devices that are no longer in use should be removed.
Passkeys significantly reduce the risk of authentication data being stolen through phishing, but they do not provide absolute protection against all types of attacks.
Note: This material is an information initiative by the IPN news agency regarding the online environment and digital infrastructure, carried out with the support of the Cybersecurity Agency.
