Are passkeys the end of passwords? Probably.

In an era where digital security is more critical than ever, small business owners are constantly seeking simpler, yet more secure ways to protect their online assets. Enter the world of passkeys, a revolutionary step towards a passwordless future. This guide aims to demystify passkeys for non-technical small business owners, offering a clear understanding of what they are, how they work, and the benefits they bring to the table.

What is a Passkey (also known as ‘passwordless’)?

A passkey is essentially a digital key that allows users to access online services, apps, or devices without the need for traditional passwords. Instead of remembering complex and often forgettable strings of characters, users can authenticate their identity using something they have (like a smartphone), something they are (like a fingerprint or face recognition), or something they know (like a PIN), or even a combination of these factors.

How Do Passkeys Work in Practice?

Imagine you’re trying to access your business’s online banking account. With passkeys, instead of typing a password, you might simply receive a prompt on your smartphone asking you to confirm your identity with your fingerprint or face. Once confirmed, you’re in – no typing, no remembering, and most importantly, no password to be stolen or hacked.

How are Passkeys better or different from 2FA / MFA (two-factor authentication / multi-factor authentication)?

Passkeys and Two-Factor Authentication (2FA) / Multi-Factor Authentication (MFA) are both designed to enhance security beyond traditional password-based authentication. However, they operate on different principles and mechanisms. Understanding their distinctions is good for implementing the most effective security strategy for your needs.

Passkeys

• Passwordless Authentication: Passkeys eliminate the need for passwords altogether. They use a unique cryptographic key pair (a public and a private key) for authentication. The private key is stored securely on the user’s device and is never shared, while the public key is stored on the server.
• Device Dependent: Authentication with a passkey typically requires the device on which the passkey is stored, making it a form of “something you have” authentication.
• Simplicity and Security: Passkeys aim to simplify the login process by removing the need for users to remember any passwords while providing a high level of security. They can be used in conjunction with biometrics (like fingerprint or face recognition) or a PIN for device-level security.

2FA / MFA

• Additional Layer of Security: 2FA and MFA add an extra layer of security to password-based authentication. After entering their password, users must provide one or more additional verification factors, which could be a passcode sent to their phone (something they have), a fingerprint (something they are), or another password (something they know).
• Enhances Traditional Passwords: Unlike passkeys, 2FA/MFA doesn’t eliminate the need for passwords. It builds on the traditional password model by adding more hurdles for unauthorized access.
• Versatility: 2FA and MFA can be implemented in various ways, offering flexibility in choosing the right level of security for different scenarios. This can include SMS codes, authenticator app codes, physical tokens, or biometric verification.

Key Differences

1. Password Requirement: Passkeys eliminate passwords, while 2FA/MFA adds steps to the traditional password process.
2. Authentication Model: Passkeys use a cryptographic key pair, making them inherently more secure and less susceptible to phishing, replay attacks, or credential theft. 2FA/MFA, while significantly improving security over passwords alone, still relies on the initial password layer and can be vulnerable to sophisticated attacks.
3. User Experience: Passkeys streamline the login process, potentially offering a more user-friendly experience. 2FA/MFA, by adding extra steps, can be seen as less convenient, though this trade-off is generally accepted for the sake of enhanced security.

What if I lose my Passkey device(s)?

1. Passkeys ARE recoverable, assuming they’re backed up into the cloud, e.g. Apple’s iCloud or equivalent. See this article from Apple: https://support.apple.com/en-gb/102195
2. It’s recommended to securely retain at least one older method of accessing your account (e.g. username + password + 2FA). But the idea/hope is that you never have to use this. Use a good password manager to store the details like LastPass or 1Pass.
3. Many software systems also offer up one or more ‘backup codes’ for you to save. You can use these if 1+2 (above) fail. Again, use a good password manager system to store these securely.

Getting Started with Passkeys

1. Educate Yourself:
   • https://passkeys.dev/
   • https://www.passkeys.io/ (includes a test/demo)
   • https://support.apple.com/en-gb/guide/iphone/iphf538ea8d0/ios
   • https://blog.google/inside-google/googlers/ask-a-techspert/how-passkeys-work/
2. Consult with Your IT Team or Service Providers: Begin by discussing with your technology partners or service providers about integrating passkey technology into your business operations. Many cloud services, apps, and software providers are increasingly supporting passkey-based logins, and many more are getting on-board all the time:
   • https://www.passkeys.io/who-supports-passkeys
   • https://passkeys.dev/device-support/
3. Educate Your Team: It’s important to train your employees on the new authentication process. Ensure they understand the benefits and know how to use their passkeys correctly.
4. Implement Gradually: Start with non-critical systems to allow everyone to get comfortable with the technology before expanding its use to more sensitive areas of your business. If you have a WordPress, there’s a very easy-to-use plugin to implement Passkeys for logging into the backend: https://wordpress.org/plugins/wp-webauthn/

The Benefits for Small Businesses

• Enhanced Security: Passkeys are more secure than traditional passwords because they’re harder to steal, guess, or hack.
• Simplified Login Process: They offer a smoother, more user-friendly login experience, potentially increasing efficiency and reducing frustration.
• Cost Efficiency: Reducing password-related support requests (like resets) can save businesses time and money.
• Future-Proofing: As digital security evolves, adopting passkeys can keep your business ahead of the curve in cybersecurity practices.

Considerations and Challenges

While the benefits are compelling, it’s important to acknowledge some considerations. Transitioning to a passkey system may require an initial investment in technology and training. Additionally, ensuring compatibility across all devices and platforms used in your business can be a challenge. However, these hurdles are often outweighed by the long-term advantages of improved security and convenience.

Conclusion

For small business owners, embracing passkeys can be a significant step forward in enhancing digital security and streamlining operations. By understanding and adopting this passwordless authentication method, you can protect your business more effectively against cyber threats, improve user experience, and prepare for a future where passwords become a thing of the past. As with any technological advancement, staying informed, consulting with experts, and taking a gradual approach to implementation will ensure a smooth transition to this innovative security measure.