Celebrating a Milestone in Biometrics: The Introduction of Passkeys

The introduction of passkeys to Google (as announced widely yesterday for World Password Day) marks an important milestone in biometric authentication. It will accelerate the adoption of more secure and convenient means of authentication for everyone.?Congratulations to all those who have been working tirelessly for years to develop and promote Fido (Fast Identity Online) which is the underpinning of the passkey protocol.

The progress made in the mainstream adoption of biometric authentication over the past year has been significant. We’ve seen a number of companies, such as Apple, Microsoft, and Google, roll out passkey technology using biometrics as an alternative to passwords.

Passkeys are a form of cryptographic authentication, where a private key is stored on the user’s device and a corresponding public key is uploaded to the authentication provider. The activation of the private key can only be done with the authorization of the user, commonly using a biometric. This eliminates the need for users to remember complex passwords, or risk their accounts being compromised if a password is stolen.

While passkeys may provide a more secure and convenient authentication experience, there are still some risks associated with them. For example, the biometric must be secure against presentation attacks (e.g, Masks), if a user’s device is lost or stolen, then their authentication credentials may be lost if not backed up. Additionally, if the authentication provider’s system is compromised, then the user’s credentials could be exposed. The intersection between Passkey and verifiable credentials will be an interesting space to watch.

As we continue to move away from passwords and towards more secure authentication methods, it’s important to remember that security is a process, not a product.

(Disclosure: BixeLab is an accredited biometric FIDO testing laboratory.)

• Google: Rolled out passkey technology on World Password Day
• Apple: Introduced passkey technology in iOS16 and latest MacOS release
• Microsoft: Using passkey through Authenticator app