Module 2 · 2.4

English

Nederlands English Deutsch

Passkeys and security keys

Module 2: Passwords and logging in · Reading time: 10 minutes

Learning objective: After this lesson you can explain why passkeys and security keys are phishing-resistant, name the difference between synced and device-bound passkeys, and decide when to use them.

Key concepts: passkey, FIDO2, WebAuthn, public and private key, bound to the domain, security key, synced passkey, device-bound passkey

The problem with anything you type in yourself

In lesson 2.3 you saw that a code from an app or text message doesn't protect you against a convincing fake site. You type the code into rnijnbank.example, the scammer forwards it within seconds to mijnbank.example and is in. The weak point is always the same: you have to judge whether you're on the real site. A person in a hurry, or one who sees a convincing page, will make that mistake sooner or later.

Passkeys and security keys take that decision away from you. It's not you who checks the address, but your browser and your device. And there's nothing to type in or forward.

What a passkey is

A passkey is a sign-in method that replaces a password. The FIDO Alliance, the organisation behind the standard, describes it as a replacement for the password that you unlock the same way you unlock your device: with your fingerprint, your face, or your PIN.

Technically, a passkey is a key pair:

a private key that stays on your device (or in your password manager, see below) and never goes to the website;
a public key that the website keeps.

Whatever is signed with the private key can be verified by the website using the public key. But you can't sign anything yourself with the public key. If the website's database leaks, the attacker only gets public keys, and they can't log in with those. So there's nothing to crack, unlike the leaked passwords from lesson 2.1.

The technology is called FIDO2. The part that lives in your browser is WebAuthn, a standard from the W3C (the consortium that develops web standards). The part between your computer and a separate security key is called CTAP.

How signing in works

On mijnbank.example you choose "Sign in with passkey".
The website sends a random challenge: a number that is used only once.
Your browser passes that challenge to your device, together with the domain you're on.
Your device asks you to unlock: fingerprint, face, or PIN. That check happens on your device. Your fingerprint never goes to the website; the website only learns that the check succeeded.
Your device signs the challenge with the private key that belongs to mijnbank.example.
The website checks the signature with your public key. If it matches, you're in.

Why a passkey doesn't work on a fake site

When you create a passkey, it's linked to the website's domain. In WebAuthn this is called the Relying Party ID: the passkey belongs to mijnbank.example (and possibly its subdomains) and nothing else. The browser determines which domain is in the request, not the website. A fake site can't forge that.

If you end up, via a phishing email, on https://rnijnbank.example or https://mijnbank.example.inlog-check.example, this happens:

The fake site asks for a passkey.
Your browser looks for a passkey for that domain. There isn't one.
You get a message such as "no passkey for this site" or an empty selection list.

There's nothing you can accidentally approve or type in. Even if you don't notice the fake site, the passkey simply won't work there. That's what we mean by phishing-resistant. NIST says the same: phishing resistance requires cryptographic authentication; passwords, codes you type in, and approval notifications are not it.

Do you suddenly get only a password field, or a request to "just enter a code from your app", on a site where you always sign in with a passkey? That's a warning sign. Check the address.

Synced or device-bound

There are two types of passkeys. The difference lies in where the private key lives.

	Synced passkey	Device-bound passkey
Where is the private key stored?	In a passkey provider: your operating system's keychain or your password manager, which copies it in encrypted form to your other devices	On one device, for example a security key, and it can't leave it
New phone?	The passkey comes along when you sign in to your provider	You have to create a new passkey on the new device
Lost your device?	No problem as long as your provider account is secure	Without a spare, you're locked out
Weak point	The account with your provider: whoever gets in there has all your passkeys	Loss; you need a backup key
Suitable for	Almost all everyday accounts	Admin accounts, hosting, domain registration, banking, the provider account itself

In the WebAuthn standard, a synced passkey is called a "multi-device credential". The FIDO Alliance calls device-bound passkeys on a security key the form with the highest level of assurance, and also recommends a security key as a recovery method if you lose access to your synced devices.

If you use synced passkeys, protect your provider account extra well: a strong password, two-factor authentication (2FA), and ideally a security key of your own.

Security keys

A security key is a small device that you plug into a USB port or hold against your phone (NFC). It holds device-bound passkeys. You sign in by touching the key, often together with a PIN on the key itself or a fingerprint on the key.

There are several manufacturers; when choosing one, check for FIDO2 support, the connector you need (USB-A, USB-C, NFC), and whether it supports a PIN or fingerprint.

The most important rule: always register at least two keys. The second is your backup key. You link it to every service, just like the first one, and keep it in a different place, for example at home in a drawer or in a safe. If you lose your everyday key, you sign in with the backup, remove the lost key from your accounts, and buy a new second one. A key can't be copied; that's exactly the point.

Signing in on a different computer

You want to sign in on a laptop, but your passkey is on your phone. The browser will often offer to show a QR code. You scan it with your phone and unlock there. The FIDO Alliance calls this cross-device authentication. The phone checks via Bluetooth whether it's really near the laptop. So someone who only has a photo of the QR code can't use it to sign in remotely.

Pitfalls and when to use them

Passkeys are a big step forward, but not magic:

The password often still exists. Many services let you sign in with password plus code alongside the passkey. A scammer will then try that route. If you can, turn off the old sign-in methods, or make the password long and unique.
Recovery is the weakest link. If someone can bypass your passkey with a "forgot password" email or a call to the helpdesk, your account is only as strong as that recovery route. Check what recovery details are set up (lesson 2.5).
Not every service supports it. Use an authenticator app instead.
Shared accounts don't fit well with passkeys on one personal device. It's better to give everyone their own account with their own passkey (module 7).
An unlocked device is an open door. Protect your phone and laptop with a good screen lock (module 5).

Where do you start? With the accounts that would cause the most damage if taken over: your email, your password manager or passkey provider, hosting and domain registration, banking and bookkeeping. If one of those services offers passkeys or security keys, turn it on there first.

Summary

A passkey is a key pair: the private key stays with you, the website only has the public key. A breach at the website gives an attacker nothing to crack.
The browser links the passkey to the real domain. On a fake site there's no passkey, so there's nothing to steal or approve.
Synced passkeys travel with you to your other devices; device-bound passkeys (security key) stay on one device.
Always register a backup key and keep it in a different place.
A passkey is only as strong as the recovery route and the old sign-in methods that are still enabled.

Quiz

Exercise

Exercise D2.4: Your first passkey or security key. Find out which of your most important accounts support passkeys or security keys, set one up for at least one of them, and arrange a backup. Tick off the checklist and answer the reflection questions.

Exercise D2.4: Your first passkey or security key

Here's how to go about it: (1) Check your most important accounts (email, password manager or passkey provider, hosting, domain registration, bank, bookkeeping) in the security settings to see whether they support passkeys or security keys. (2) Choose for each account: a synced passkey (in your operating system or password manager) or a device-bound one (security key). For managing hosting, domains and your passkey provider, a security key is preferable. (3) Set up a passkey or key for at least one account. (4) Arrange a backup: register a second key and keep it in a different place, or for a synced passkey, a second device and good protection of your provider account. (5) Check whether the old way of logging in (password with text message or code) is still switched on. Turn it off if you can, or make the password long and unique. (6) Test logging in on a second device once (for example using the QR code and your phone).

Made an overview of which of my accounts support passkeys or keys
Set up a passkey or key for at least one important account
Backup arranged (second key or second device)
Backup key is kept in a different place from the everyday one
Account with my passkey provider given extra protection
Old way of logging in switched off or made strong

Why did you choose synced or device-bound for this account?

What happens if you lose your everyday key or phone? Describe how you'd get back in.

Which recovery route for this account (email, text message, helpdesk) is now the weakest link?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing