n a recent BBC article, reporter Liv McMohan says that the UK’s National Cyber Security Centre (NCSC) recommends using passkeys instead of passwords to better protect online accounts from hackers. She explains that many people reuse the same password across different accounts or choose simple, easy-to-guess combinations, which makes their accounts more vulnerable for online attacks.
McMohan emphasizes that tech experts agree passkeys can be more secure, but they also caution that they are not completely foolproof.
Instead of you creating and remembering a shared secret, like a password, your device generates a secure key pair – one part stays on your device, and the other sits with the service you’re logging into.
– Daniel Card of BCS, the Chartered Institute for IT (source: BBC)
In her beginner-friendly article, McMohan explains what passkeys are and how they work. Here is a brief summary:
- What are passkeys? McMohan explains that passkeys work differently from passwords. Instead of using a string of characters, they rely on cryptography to confirm your identity through your device. Each passkey is tied to a specific website and does not share sensitive data. Companies like Google and Apple support this method, which uses features such as Face ID or Touch ID for sign-in. Tech experts recommend this approach improves security and makes logging in simpler for users.
- How do they work? Passkeys use public key cryptography to create a secure pair of keys, one on your device and one with the service. When you unlock your device using biometrics or a PIN, it confirms your identity without sharing sensitive information. “These physical security keys are totally resistant to phishing attempts and can’t be intercepted or stolen by remote attackers, meaning only the key holder can gain access to their accounts,” Niall McConachie, regional director at cyber-security firm Yubico, told BBC.
- Passkeys are not silver bullets: McMohan notes that experts from the NCSC and others believe passkeys can be more secure than multi factor authentication (MFA) methods. However, losing your device can make them harder to use. She also explains that the NCSC did not strongly recommend passkeys in the past because of implementation challenges and limited platform support. These issues have now improved, and the method is becoming more popular.
Fido Alliance advocates for passkeys technology and a password-less future, are now supported by major operating systems and browsers, are gaining traction, including adoption by the UK Government.
Card told BBC, “Moving from passwords to password managers, app-based MFA, and now passkeys is a step change in reducing risk. That’s why organizations like the NCSC are backing them, and why many in the security community are already adopting them wherever they’re available”.
Acknowledgement: This summary was generated using AI writing tools as part of my experimental learning process. For more information, please refer to the original articles listed below.