Passkeys and WebAuthn: The Future of Secure and Seamless Authentication

Generated with chat.mistral.ai

Imagine starting your day scrolling through Instagram in the bathroom and ending it with TikTok in bed, while even your Oura ring tracks your sleep. Nearly every app you use demands a login with a username and a password. You might think, “I can just use a password manager.” But what about data breaches like the LastPass incident in 2022? Plus, many people end up reusing passwords across multiple apps, which isn’t secure. With hundreds of passwords to remember, complex requirements, and the fact that most of us dislike managing them — except maybe hackers — it’s clear we need a smarter solution. Passwordless is the solution

Existing Passwordless Solutions

To eliminate passwords, several passwordless authentication methods have been introduced. Here are some of the most commonly used ones.

• Magic Links — Login via email-based one-time links.
• Push Notifications — Approve login requests on your device.
• One-Time Passwords (OTP) — Temporary codes sent via SMS or email.
• Biometric Authentication — Fingerprint or face recognition on devices.
• Social Logins (OIDC Based)— Sign in using Google, Apple, or Facebook.

While these methods improve convenience, they still have security risks like phishing, interception, and account recovery vulnerabilities, making them less than ideal. So the real future of Passwordless authentication lies in Passkeys.

Comparison of Authentication Methods

As listed here, Passwords are knowledge-based, requiring something you know, while Passkeys are possession-based, relying on something you have, making them much more secure and user-friendly.

What are the passkeys ?

Passkeys are a modern and secure way to authenticate users online, developed to replace traditional passwords. The concept originates from the FIDO Alliance, an organization established to promote passwordless authentication methods. FIDO’s goal is to make online authentication both safer and easier.

Passkeys are built on FIDO2 standard,, an industry standard designed for secure, passwordless authentication. It consists of:

• WebAuthn (Web Authentication API): A system that allows websites to replace passwords with passkeys, making logins faster and safer.
• CTAP (Client to Authenticator Protocol): A protocol that helps external security keys (like YubiKeys) communicate with your device for authentication.

https://blog.palantir.com/hardware-selection-and-logistics-passwordless-authentication-series-1-cef0a4550fab

Together, these standards ensure that passkeys work securely across different devices and browsers, eliminating the risks of weak or stolen passwords.

How Do Passkeys Work?

Passkeys use public key cryptography, which relies on two keys: a public key and a private key.

• Private Key: Stored securely on the user’s device and never leaves it. It is used to sign authentication requests.
• Public Key: Stored on the server and linked to the user’s account. It verifies the signature from the private key.

The basis of passkey is PKE, Refer to this for detailed explanation : https://cheapsslsecurity.com/p/what-is-public-key-and-private-key-cryptography-and-how-does-it-work/

No Password Storage

Unlike traditional passwords, passkeys do not store sensitive data on servers. The server only keeps the public key, reducing the risk of credential theft.

Authentication Process

1. When a user logs in, the server sends a challenge.
2. The user’s device signs this challenge with its private key.
3. If the signature matches the public key stored on the server, access is granted.

Since the private key never leaves the device, there’s no risk of it being stolen from a database breach.

Role of Authenticators in Passkey Implementation

Authenticators are the tools that handle passkeys. They generate and store private keys and sign authentication requests when you log in. There are two types:

• Platform Authenticators (Built-in security)
  - These are part of your device, like Face ID on iPhones or Windows Hello on a PC.
  - They offer easy and seamless login but work only on that device.

https://www.youtube.com/watch?v=wlosqwcOmr0

• Roaming Authenticators (Portable security keys)
  - These are external devices, like USB security keys (e.g., YubiKey) or Bluetooth-based authenticators.
  - They work across multiple devices, making them useful for backup access.

https://www.yubico.com/products/

Both types keep your private key protected and ensure only you can sign in, even if someone else has your device or login details.

Synchronized vs. Hardware Bound

Passkeys also can be divided into two categories: synchronized passkeys and hardware-bound passkeys. These two types determine how and where your passkeys are stored and accessed, offering different levels of convenience and security.

https://hideez.com/en-int/blogs/news/fido2-explained

Synchronized Passkeys

• What They Are: Synchronized passkeys are stored in the cloud and can be accessed across multiple devices. This means that once you set up a passkey on one device (like your phone), it automatically syncs with all your other devices, such as your laptop, tablet, or other phones.
• How They Work: When you authenticate using a synchronized passkey, your device retrieves the passkey from the cloud. This makes it easy to access your accounts from different devices without needing to set up passkeys individually on each one.

Benefits:

• Convenient: You don’t have to worry about setting up passkeys on every single device you use. Once you set up one, it’s synced automatically.
• Accessible Anywhere: You can log in to your accounts on any device where you’re signed in to your cloud account.

Drawback

• The security of synchronized passkeys depends on the security of your cloud service. If your cloud account is compromised, the passkeys could be at risk.

Hardware-Bound Passkeys

• What They Are: Hardware-bound passkeys are stored directly on physical devices like your phone, laptop, or a USB security key. These passkeys are tied to the specific device and cannot be accessed from other devices unless you physically connect the key.
• How They Work: With hardware-bound passkeys, the authentication process is device-specific. For example, if you have a security key or a phone with Face ID, you would need that device to authenticate, and the private key never leaves the device.

Benefits:

• More Secure: Since the private key is stored on the physical device, it’s much harder for hackers to access it. Even if a hacker gets into your cloud account, they won’t be able to use your hardware-bound passkey without the device itself.
• Offline Capability: Hardware-bound passkeys can work without an internet connection, since they are stored directly on the device.

Drawback:

• Less Convenient: You need to have the device with the passkey to log in. If you lose your device, you could lose access to your accounts unless you have a backup authentication method.

Role of WebAuthn in Passkey

For passkeys to function effectively, browsers must support WebAuthn, a W3C standard developed to facilitate secure, passwordless authentication through public key cryptography. WebAuthn enables web applications to register and authenticate users without relying on passwords, enhancing both security and user convenience.

Get Shanaka Sandanayaka’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

By standardizing the authentication process, WebAuthn ensures compatibility across various browsers and devices, making passkey-based authentication accessible and reliable for users worldwide.

WebAuthn in Passkey Implementation

When you log in using passkeys, WebAuthn is the technology that helps make it all work securely. Let’s break down the process in simple steps.

There are three main parts that work together:

1. Authenticator

• The Authenticator is the device or security key that holds your private key.
• For example, it can be your phone (with Face ID or fingerprint), a USB security key, or any other device used to verify your identity.
• The Authenticator is responsible for signing your login request and proving you are who you say you are.

2. Relying Party (RP)

• The Relying Party is the website or app that you want to log into.
• It’s responsible for storing the public key associated with your account and asking for authentication when you try to sign in.
• It sends a request to your Authenticator to confirm your identity.

3. Client

• The Client is the device (like your laptop, phone, or tablet) that connects you to the Relying Party.
• It helps manage the communication between the Authenticator and the Relying Party.
• The client works through the browser to handle the authentication process, ensuring it’s smooth and secure.

How WebAuthn Works: Client Authentication and the Browser API

WebAuthn simplifies secure login by replacing passwords with passkeys. Here’s how it works in a simple and clear process, focusing on client authentication and how the WebAuthn API works inside the browser.

Highly recommended to watch this, as it provides an excellent explanation of WebAuthn. https://www.youtube.com/watch?v=rsJcXHUZhRY&t

Let’s explore how registration and authentication work when using passkeys with WebAuthn.

Registering Secure Passkeys with WebAuthn

https://dev-octopus.tistory.com/25

• Relying Party (RP) Creates Request: Relying Party (RP) sends a request to WebAuthn client with necessary options (RP info, user ID, challenge) for user authentication.
• Request sent to authenticator : The client proxies the request to the authenticator, presenting a list if multiple authenticators are available.
  Browser API: navigator.credentials.create()
• User consent : User consents to create new credentials on the selected authenticator for the RP.
• Authenticator creates credentials : Authenticator generates a public/private key pair. The public key is embedded in the signed response, along with origin information.
• Response sent to RP : Authenticator sends the signed response back to the RP, via the client as a proxy.
• RP verifies the response : RP validates the authenticity of the response, checks for tampering, and verifies the origin to prevent phishing.
• Registration complete : RP saves user data and the public key, completing the registration.

WebAuthn Authentication Process

https://dev-octopus.tistory.com/25

• Relying Party (RP) initiates authentication request : RP performs a GET request to the WebAuthn API, passing an options object containing identifying information for the RP.
• Authenticator prompts user for consent : Authenticator asks the user if they want to authenticate to the requesting RP.
  Browser API: navigator.credentials.get()
• User confirms authentication : Upon user confirmation, the authenticator sends a signed response using the private key from the registration ceremony.
• RP receives and validates response : RP uses the stored public key to verify the signature of the response and authenticate the user. RP also checks the origin in the response to ensure it matches the expected source to prevent phishing.

This demo provides a comprehensive explanation of the entire process, including all payloads for the API calls. https://shagihan.github.io/webauthn/

Passkeys represent the future of passwordless security, offering a more secure and user-friendly way to protect our online accounts. By eliminating traditional passwords, passkeys make it much harder for hackers to gain access. However, as users, we must still take necessary precautions. It’s essential to secure our devices and avoid negligence, such as leaving devices unattended or unprotected, to ensure our passkeys remain safe. By doing so, we can fully embrace the benefits of this advanced security technology while protecting our personal information from potential threats.

References

• https://webauthn.io/
• https://hideez.com/en-int/blogs/news/fido2-explained
• https://webauthn.me/?utm_source=auth0_docs&utm_medium=organic_dist&utm_campaign=auth0-docs
• https://auth0.com/blog/webauthn-and-passkeys-for-developers/
• https://teampassword.com/blog/passkey-vs-webauthn
• https://auth0.com/docs/secure/multi-factor-authentication/fido-authentication-with-webauthn