I know Google implemented it but is it literally just using our phone’s biometrics to access third party apps and websites? How’s it different from an app asking for you fingerprint when you sign in? Is it only an Android thing?
In: Technology
Let’s imagine your Gmail account is a box safe in your house. In order to access the stuff you keep stored in your safe (your emails), you need a way to open the safe.
Your password would be like a combination lock. It’s convenient because as long as you know the combination (password), you can open the safe. That convenience can be a risk, however, because someone could steal your combination, or if given enough time, they could guess your combination by trying all possible combinations until they find yours (brute-force crack your password).
A passkey would be like a key lock. It’s a little less convenient because you must have the key to open your safe, but it’s much more secure because it’s much harder to guess/figure out a key pattern or create a copy of the key. However, if you lose your keyring (phone), you won’t be able to access your safe.
This explanation leaves out a lot of nuance obviously, but this is a rough analogy that’s easy to understand.
Fingerprint/Touch ID/Face ID is technically separate from a passkey, but it is the most common method by which to authenticate a passkey. So most people who interact with passkeys now and in the future will do so by verifying their identity with biometrics, which will give your device permission to “put the key in the slot” and unlock a given account.
Latest Answers