Passwords have been the standard for login for decades, yet they are also one of the biggest vulnerabilities. They are reused, guessed, stolen in data breaches or intercepted on fake login pages. Passkeys solve precisely these problems: instead of a secret that you have to remember and type in, your device uses a cryptographic key pair. Passkeys are based on open standards from the FIDO Alliance and the W3C (WebAuthn). Apple, Google and Microsoft support them in their operating systems and browsers.
How a passkey works
- Set-up: When you create a passkey, your device generates a key pair. The public key is sent to the service, whilst the private key remains securely stored on your device or in your password manager.
- Login: The service sends a random challenge. Your device solves it using the private key after you’ve unlocked it with your fingerprint, facial recognition or device PIN.
- Verification: The service verifies the response using the public key. If it matches, you are logged in.
Your fingerprint or face never leaves the device during this process. You simply unlock the key locally; the service does not receive any biometric data.
Why passkeys are more secure
- Protection against phishing: A passkey is permanently linked to the service’s genuine address. It simply won’t work on a fake website, even if it looks deceptively real.
- Nothing to steal: Only the public key is stored on the server. If it is compromised in a data breach, nobody can do anything with it.
- No reuse: A separate passkey is generated for each service. A breach at one provider does not put other accounts at risk.
- Two factors in one step: You need your device and your fingerprint or PIN. This follows the principle of two-factor authentication, without having to type in a code.
Synchronised or tied to a device
There are two types of passkeys:
- Synchronised passkeys are synced in encrypted form via your account, for example via iCloud Keychain, Google Password Manager or a password manager such as 1Password or Bitwarden. They are therefore available on all your devices and won’t be lost if you get a new smartphone.
- Device-bound passkeys are stored, for example, on a security key such as a YubiKey and cannot be copied. This offers the highest level of protection, for example for administrators.
Login on someone else’s computer
Do you want to perform a login on a computer on which your passkey isn’t stored? In that case, the browser will display a QR code. You scan it with your smartphone, confirm the login there, and the computer is logged in. To ensure no one can eavesdrop remotely, the devices use Bluetooth to verify that they are in close proximity. The passkey itself remains on your smartphone.
What happens if you lose your smartphone?
- Synchronised passkeys will reappear on your new device once you’ve completed the login for your Apple, Google or password manager account.
- Set up at least two passkeys, for example on your smartphone and laptop, or additionally on a security key.
- Keep a backup option: a strong password with two-factor authentication and securely stored recovery codes will also allow you to access your account in an emergency.
- Remove lost devices from your list of passkeys as soon as you’ve completed another login.
Passkeys in the SpeedIT customer area
You can already perform the login using passkeys in our customer area. Here’s how to set one up:
- In the customer area, click on your name to open the ‘Security’ section.
- In the ‘Passkeys’ section, click on ‘Add passkey’.
- Confirm the device authentication, for example using your fingerprint.
- Give the passkey a name, for example ‘Office laptop’, so that you can recognise it later.
From then on, simply click on ‘Log in with Passkey’ on the login page. You can find detailed instructions in our knowledge base under ‘Set up and manage Passkeys’.
Our recommendation
Use passkeys wherever they are available, and start with your most important accounts: email, web hosting, domains and banking. Make sure you have a second login method for each account, and name your passkeys after the device so you can keep track of them.
Conclusion
Passkeys make the login both easier and more secure. You don’t need to remember anything or type anything in, and you’re effectively protected against the most common form of attack: phishing. If you set up two passkeys and retain a second login method, you won’t need to worry even if you lose your device. You can read more about securing your account in our article ‘Setting up two-factor authentication’.
