Nobody likes remembering passwords. We reuse them, we forget them, and we waste hours requesting reset links across dozens of forgotten apps and websites. A password manager certainly cushions the blow, but it can’t fix the root problem: As long as a password exists on a company’s server, it can be leaked, stolen, or bought on the dark web.
Fortunately, a far better solution is starting to replace the status quo. Instead of forcing you to type out secret codes, a growing number of services now let you set up a passkey. This device-specific authentication method ties your account access directly to the hardware you already own, such as your phone or computer. Though widespread adoption will take time, passkeys are set to kill off traditional logins for good, giving everyday users the upper hand against database hackers.
How Passkeys Work (And Neutralize Database Hacks)
Apps or websites store your unique public key. A private key is stored on your device, in your password manager, or, if you’re an Apple user, in your iCloud keychain. After your device (or iCloud) authenticates your identity, the two keys combine to grant you access to your account.
(Credit: 1Password/PCMag)
The Fast Identity Online (FIDO) Alliance developed passkeys several years ago, and the technology offers numerous benefits. For example, passkeys cannot be guessed or shared. Also, passkeys resist some phishing attempts because they’re unique to the sites they’re created for, so they won’t work on fraudulent lookalikes. Most importantly, in the age of near-constant data breaches, your passkeys cannot be stolen by hacking into a company’s server or database, making the stolen data far less valuable to criminals.
To learn how to set up passkeys for your online accounts, check out our guide to setting up and using passkeys.
Are Passkeys Bulletproof? (Plus the Cookie Setting You Must Fix)
Allowing users to login using a passkey isn’t the only update website owners need to ensure website security. To learn more about the risks, I spoke with Trevor Hilligoss, a security researcher and chief intelligence officer at SpyCloud. Hilligoss tells me that widespread passkey adoption is “fantastic,” but website owners must also fix other security holes. He noted that criminals can easily bypass a passkey by stealing users’ validated browser cookies via malware.
“You can use a passkey, you can use a password manager, you can use ‘yourdog’sname2023,’ whatever. It doesn’t really matter because authentication has already happened by using that cookie,” Hilligoss says. “Criminals are emulating an already authenticated session. So from the perspective of the website, it just sees that it’s a valid cookie.”
Hilligoss says that once a website, such as your email service, validates the cookie, the criminal doesn’t need to log in with your credentials or authenticate their identity. The cookie, which persists in a person’s browser for seconds or years, allows criminals to access your accounts undetected and steal your data or money.
The onus is on website owners to find a solution for cookie hijacking. Hilligoss tells me that the rest of us can protect ourselves from the cookie-hijacking threat by using passkeys or strong, unique passwords wherever possible. He adds that some websites allow users to choose when their session tokens expire.
Recommended by Our Editors
You know the data privacy pop-up screens? Don’t immediately tap “Accept.” Instead, navigate to the “Cookies” or “User Data” sections and choose the shortest available session duration. That way, your cookies will expire automatically or whenever you close your browser window.
How to Manage Your Passkeys Across All Your Devices
Speaking of password managers, many of the services I’ve reviewed for PCMag, such as Editors’ Choice award winners NordPass and Proton Pass, can store and generate passkeys for you. Android and iOS users can store passkeys using the built-in Apple Passwords app or Google Password Manager.
The Best Password Managers With Passkey Storage
Microsoft is doing its part to eliminate passwords by encouraging its customers to use passkeys and making all new accounts password-less by default. The company even removed the password management functions from Microsoft Authenticator, but preserved the passkey storage options.
A password manager makes it easy to access both your old credentials and new passkeys when you log in. Check out this list of our top picks for password managers.
About Our Expert
Kim Key
Senior Writer, Security
Experience
I review privacy tools like hardware security keys, password managers, private messaging apps, and ad-blocking software. I also report on online scams and offer advice to families and individuals about staying safe on the internet. Before joining PCMag, I wrote about tech and video games for CNN, Fanbyte, Mashable, The New York Times, and TechRadar. I also worked at CNN International, where I did field producing and reporting on sports that are popular with worldwide audiences.
In addition to the categories below, I exclusively cover ad blockers, authenticator apps, hardware security keys, and private messaging apps.
Click Here For The Original Source.
