Cybersecurity: The Importance of Passkeys

Cybersecurity is ever-evolving, and it sometimes feels like a tiring ordeal to stay safe online. Recently, though, the introduction of passkeys has eased some of that frustration.

You might be asking: What are passkeys?

In short, a passkey gives a user the ability to log in to an account without typing a password. According to the National Cybersecurity Alliance, passkeys can function in different ways, such as relying on login confirmation via a separate device, such as your phone, tablet, or computer; accessing fingerprint or facial recognition data; or incorporating a device PIN. If you use a password manager such as 1Password or ProtonPass, you can also use that tool to create passkeys and link them to accounts for use in the authentication process.

Passkeys are typically thought to be more secure ways to login as there is no password for someone to steal. More platforms are adopting these sign-in methods, but some companies, including Google, Apple, and Microsoft, have already supported passkeys.

There are also physical passkeys that use FIDO2/WebAuthn credentials stored on a USB key such as YubiKey. These physical passkeys are often thought to be the most secure way to log in—even over digital passkeys—as online malicious actors must physically have the passkey to gain access to your account.

Whether digital or physical, passkeys are incredibly important as two-factor authentication is now considered generally not enough to secure your accounts. For convenience, it is best to use a respected password manager that can generate strong passwords and create passkeys. If able, a physical passkey is even better.

While the ongoing fight for cybersecurity seems exhausting, taking a few basic steps can make you more secure than most. Even simply using a respected password manager that generates strong passwords, enabling two-factor authentication (and not using the text message option), and using passkeys when possible can help tremendously. You can also visit websites such as haveibeenpwned.com to see if your data has been involved in a data breach. If it has, make sure to take the proper steps to change passwords and watch for any suspicious activity on your accounts.

For more information, visit the National Cybersecurity Alliance’s website.