Passkey vs. Password: Which Is Right for You?

In today's digital world, safeguarding our online accounts and sensitive information is of paramount importance. Traditionally, passwords have been the go-to method for protecting our digital assets. However, a new contender has emerged - passkeys. In this blog post, we will explore the intricacies of passkeys and passwords, highlighting their differences, similarities, benefits, challenges, and limitations. By the end, you'll have a better understanding of which is more secure and what the adoption of passkeys means for you.

What Is a Passkey?

In technical terms, a passkey is a unique cryptographic key that is generated and used for authentication purposes. It is based on public-key cryptography, which involves a pair of keys: a public key and a private key.

When a user creates a passkey, the system generates a public-private key pair. The public key is shared with the service provider or server, while the private key is securely stored on the user's device. The passkey is usually protected by a user-generated PIN or biometric authentication.

When the user wants to authenticate themselves, the server sends a challenge to the user's device. The device then uses the private key to sign the challenge, creating a digital signature. The server verifies the signature using the user's public key, and if the signature is valid, the user is granted access.

What does a passkey mean for you?

1. Because passkeys cannot be shared like passwords and only exist on your device, a bad actor can't trick you into sharing them. 
2. You don't have to remember passwords for accounts that support passkeys. Instead, you use a local PIN or the same biometric authentication method you use to unlock you device (like fingerprint or face).

Passkeys validate you when you prove that you own the authorized device, rather than when you know the correct password. The PIN or biometric authentication is your private key - it's not shared to a server.

In summary: passkeys are faster and safer. The internet is moving toward passkeys, but it will be years before they're universally supported. 

Time spent authenticating with passkey vs password (data from March-April 2023). Dashed, vertical lines indicate average duration for each authentication method (n≈100M) 

Source: Google Blog

How Does a Passkey Work?

Passkeys offer a more secure alternative to passwords by utilizing asymmetric encryption, a cryptographic technique that employs a pair of mathematically linked keys: a public key and a private key. Here's a breakdown of how it works and its advantages:

The Key Pair:

1. Private Key: This key is the crown jewel, kept securely on the user's device (phone, computer, etc.) It's like a super-secret recipe only the user possesses. Passwords managers or secure enclaves within the device can be used for secure storage and access control (often requiring biometrics or a PIN).

2. Public Key: This key, as the name suggests, can be shared with the service provider (website, app) during registration. Think of it as a publicly available lock. While anyone can see it, only the private key (the recipe) can unlock it.

The Authentication Dance:

1. Challenge Issued: During login, the service provider generates a random challenge, a piece of data unique to that login attempt.

2. Challenge Encryption: The service provider encrypts the challenge using the user's public key (the publicly available lock). This encryption ensures only the corresponding private key can decrypt it.

3. Private Key Decryption: The challenge is sent to the user's device. There, the private key decrypts the challenge, proving the user possesses the key that matches the public key shared with the service provider.

4. Verification and Access: The decrypted challenge is sent back to the service provider. If the decrypted challenge matches the original challenge, it confirms the user holds the private key and grants access.

For a more in-depth explanation of how passkeys work, read the article: How do passkeys work? 

Benefits of Passkeys:

• Enhanced security:
  • Passkeys are not susceptible to common attack vectors like phishing or password reuse. There are no "weak" or "reused" passkeys.
  • If a cybercriminal breaches a website and steals your public key, they'll discover it's useless without the private key which is only stored on your device.
• Convenience and usability: Passkeys can provide a seamless and user-friendly authentication experience, eliminating the need for users to remember complex passwords.
• Reduced reliance on servers: Since passkeys are not stored on servers, they are less susceptible to large-scale data breaches.

What Is a Password?

A password is a string of characters used to authenticate a user's identity. It is a secret piece of information known only to the user and the service provider. Passwords have been widely used as a security measure for online accounts, applications, and various digital services.

How Does a Password Work?

Passwords are typically stored on servers, either in plaintext (not secure) or in a hashed and salted format (more secure). During authentication, the user provides their password, which is then compared against the stored value. If the two match, the user is granted access.

If a hacker were to gain access to the server where the passwords are stored, they would have complete control over all the accounts. That's why passwords are hashed using one-way mathematical functions called hashing algorithms.

Here's a deeper dive into how password hashing works:

1. Hashing Algorithms: When a user creates a password, it's fed through a hashing algorithm. This algorithm scrambles the password into a fixed-length string of characters, called a hash. Common hashing algorithms used include SHA-256 and bcrypt. 

2. One-Way Function: A crucial property of hashing algorithms is that they are one-way functions. This means it's easy to compute the hash from the original password, but mathematically impossible to reverse the process and recover the original password from the hash.

3. Hashes Don't Reveal the Password: Since the hash is a scrambled version of the password, even if a hacker steals the hashed passwords, they cannot directly translate the hash back into the original password.

4. Salting: To further enhance security, a random string of characters, called a salt, is often added to the password before hashing. The salt is unique for each user and adds another layer of protection. Even if two users have the same password, their hashed passwords will be different because of the unique salt value.

5. Verification During Login: When a user logs in, the entered password is hashed using the same algorithm and salt (if used) as during account creation. The resulting hash is then compared to the stored hash. If the hashes match, the login is successful, otherwise, access is denied.

Here's an analogy: Imagine a hashing algorithm as a special one-way recipe that turns an ingredient (password) into a unique dish (hash). You can easily follow the recipe to cook the dish, but just by tasting the dish, it's impossible to know the exact ingredients used.

Benefits of Passwords:

• Familiarity and compatibility: Passwords have been the de facto method of authentication for decades, making them widely supported across various systems and platforms.
• Ease of implementation: Implementing password-based authentication is relatively straightforward for service providers and doesn't require specialized infrastructure.
• Accessibility: Passwords can be easily shared or communicated, enabling account access for multiple users or in emergency situations.
• Incremental security measures: Additional security measures like two-factor authentication (2FA) can be easily integrated with passwords for added protection.

Passkey vs. Password: Key Similarities

Here are the key similarities between passkeys and passwords:

• Both serve as methods of authentication and identity verification.
• They protect access to digital assets, online accounts, and services.
• Both can be combined with other security measures, such as multi-factor authentication, for enhanced security.
• Both passkeys and passwords require proper management and consideration of security best practices. With passwords, users must keep them private. With passkeys, users must not let their device fall into the wrong hands. 

Passkey vs. Password: Key Differences

Here are the key differences between passkeys and passwords:

• Passkeys are generated using cryptographic techniques, while passwords are user-generated.
• Passkeys are typically not transmitted or stored on servers, whereas passwords are usually stored on servers in some form - albeit in a hashed and salted form. 
• Passkeys are more resistant to phishing attacks, while passwords are vulnerable to phishing and other social engineering techniques.
• Passkeys are not as widely supported as passwords across all platforms and services.
• The complexity and security of passkeys are typically higher than those of passwords.

Current Passkey Challenges and Limitations

While passkeys offer promising security advantages, there are still some challenges and limitations to consider:

• Limited adoption: Passkeys are not yet widely supported by all websites, applications, and services, making it challenging to use them universally.
• Device dependency: Passkeys rely on the availability and security of the user's device to store and process cryptographic keys.
• Recovery and backup: If a passkey is lost or compromised, the recovery process may be more complex compared to passwords, which often have built-in recovery mechanisms.
• Sharing: Currently, passkeys are not a good solution for accounts that families or employees need to share. Companies are working on ways to share passkeys...but do you want your fingerprint shared online? 

Passkey vs. Password: Which Is Best for You?

Passkeys are the inevitable future of authentication. We recommend adopting them where possible, but for now, the possibilities are limited. 

Passkeys are undoubtedly more secure than passwords due to their resistance to common attack vectors. However, given the current limitations and challenges surrounding passkey adoption, passwords still play a crucial role in digital security. Implement strong password management practices, such as using unique passwords, enabling two-factor authentication, and regularly updating passwords.

While we wait for passkeys to become more mainstream, teams can boost their security by utilizing password management solutions like TeamPassword. TeamPassword offers features like secure password sharing, centralized management, and strong encryption, enabling teams to maintain robust security practices.

In the ongoing battle between passkeys and passwords, there is no definitive winner. Passkeys offer increased security but are limited in adoption and sharing capabilities, while passwords continue to be widely supported but have their vulnerabilities. As technology evolves, passkeys will become more prevalent, but until then, it's crucial to manage passwords effectively and leverage tools like TeamPassword to ensure optimal security for your team's digital assets.

Get a free trial of TeamPassword now!