I’ve avoided “passkeys” like the plague, but with Google [promising a password-less future](https://safety.google/authentication/passkey/) and Apple [forcefully moving people to passkeys going forward](https://developer.apple.com/videos/play/wwdc2024/10125/?time=258), I guess it’s time to figure out what they are.
I consider myself a tech person, but the more I hear about these *passkeys*, the less I understand. Apple’s [overview](https://developer.apple.com/passkeys/) says that they’ll be used “alongside” passwords, so I don’t get what’s being **replaced**, and why the hell we need them. Fido Alliance (the folks that apparently invented the damn thing) says that [passwords are a problem](https://fidoalliance.org/passkeys/), but reading this, it doesn’t seem like it’s **my** problem they talk about.
What I **do** understand though, is that one day I’ve had someone walk into my hotel room in Poland, and walk out with my laptop and cell phone while I was asleep^1.
**So, overnight, I ended up without access to any of my devices or phone number abroad**.
Luckily, because I was still in the password-ful past, I could log into my email and Skype from hotel’s computer, and let my wife know that I need some help.
what this scenario wood look like in the future when everything gets switched to passkeys.
____
^(**[1]:**) ^(I have forgotten to lock the door – learn from my mistake. To Krakow police’s credit, they *actually caught the thief* several months later.)
In: Technology
A passkey is an encrypted file that serves as your credentials.
The problem is: users get hacked all the time because they have bad password discipline. The vast majority of hacked accounts are from phishing and social engineering, and people reuse passwords so a minor compromise can turn into a big deal.
The solution: make your login info something that you can’t give away. You literally can’t give a hacker or scammer your passkey.
Password fallback is the necessary solution to losing the device storing your passkeys. But you don’t have to make your password memorable or actively use or manage it, write it down and store it somewhere safe, and never touch it unless you lose your phone. Greatly reduces the attack vector.
Stolen phone can’t be used for passkeys unless you keep it unlocked, and even if you do you can still track and disable it remotely if they actually try to use it.
Latest Answers