{"id":2301,"date":"2024-01-04T01:00:00","date_gmt":"2024-01-04T01:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/identity-access-management-security\/how-to-get-started-using-passkeys"},"modified":"2024-01-04T01:00:00","modified_gmt":"2024-01-04T01:00:00","slug":"getting-started-with-passkeys-one-service-at-a-time","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/01\/04\/getting-started-with-passkeys-one-service-at-a-time\/","title":{"rendered":"Getting Started With Passkeys, One Service at a Time"},"content":{"rendered":"
<\/a><\/div>\n

Passkeys gained momentum in 2023.<\/span><\/p>\n

In addition to the major three technology firms supporting passkeys \u2014 Apple, Google and Microsoft \u2014 third-party password providers, such as 1Password and Bitwarden, implemented their own support for managing the credentials. Dozens, and likely hundreds, of major websites have followed suit, implementing the necessary support for passkey authentication.<\/span><\/p>\n

Overall, more than 7 billion accounts could be using passkeys, <\/span>according to the FIDO Alliance<\/a><\/span>, whose technical specifications power the authentication standard. Left unsaid: The vast majority of users are not.<\/span><\/p>\n

The whole point of passkeys is to make passwordless authentication as convenient and as secure as passwords, says Andrew Shikiar, executive director of the FIDO Alliance.<\/span><\/p>\n

“Passwords are a clear and present danger to everything we do online right now,” he says. “To take on passwords, you need to be able to proved the same characteristics as passwords \u2014 ubiquity and convenience.”<\/span><\/p>\n

For those that do want an easier and more secure way to sign into cloud services and web sites, this Tech Tip is for you.<\/span><\/p>\n

What are Passkeys?<\/h2>\n

Passkeys are the answer to the question, why should we memorize passwords for web sites when our devices have more secure ways of authentication? Windows systems, Macs, iPhones and Android devices all have ways of securely storing keys via an encrypted hardware enclave and have ways of authenticating the user through biometrics.<\/span><\/p>\n

Apple, Google, and Microsoft worked with the FIDO Alliance to establish the passkey standard using certificates for authentication that are WebAuthn compliant. Different ecosystems \u2014 such as Apple, Bitwarden, Google, 1Password or Microsoft \u2014 manage passkeys in different ways \u2014 but all support standardized passkeys.<\/span><\/p>\n

Google, which by default now asks users if they want to use passkeys, has not released data on the number of accounts that have opted into using the technology, but does say that 60% of users believe passkeys are easier to use than traditional login methods.<\/span><\/p>\n

“Similar to any new innovation, it\u2019s going to take time for people to get used to passkeys,” says Arnar Birgisson, a software engineer for Google. “Passwords are all we\u2019ve known for countless years.”<\/span><\/p>\n

A Passel of Passkeys<\/h2>\n

The first question that users should consider is whether they want to consolidate their keys under a single ecosystem or provider. For users who have exclusively bought into the Apple ecosystem, for example, using <\/span>the passkey support in the iCloud Keychain feature<\/a><\/span> of Macs, iPads and iOS devices may be completely acceptable. Similarly, users of Google Chrome can use the password capabilities of the browser <\/span>across different platforms to manage passkeys<\/a><\/span> by signing into their Google account.<\/span><\/p>\n

To avoid being locked into a specific ecosystem of hardware or browsers, however, users could instead use a third-party service. 1Password, Bitwarden, Dashlane, Enpass, and LastPass all support \u2014 or are working on support for \u2014 passkeys through their application and browser extensions, which will allow passkeys to be accessed across major device types and makes of browser. Using a single ecosystem can make passkeys simpler for the user, especially when it comes to the critical issue of key recovery.<\/span><\/p>\n

\"google-signing-in-with-passkeys.jpg\"<\/p>\n

Generating a passkey for Google on the Chrome browser using Apple’s iCloud Keychain to store the passkeys. Source: Author.<\/p>\n<\/div>\n

Creating a Passkey: Google Account Using Chrome<\/h2>\n

For personal Google accounts, or if you are the administrator of Google Workspace accounts, you can set up passkeys for your users. (The Google Workspace support is <\/span>currently in beta<\/a><\/span>.) Google supports setting up passkeys on Windows 10 and up, MacOS Ventura and later, or ChromeOS 109 and up, although recommends that users update to the most current version of their operating system.<\/span><\/p>\n

For Google accounts, users can just go to <\/span>the company’s passkey site<\/a><\/span> and click the “Get passkeys” button. Google will ask you to sign into the account you want to associate with a passkey, create the passkey, and then have the user test their access to the system.<\/span><\/p>\n

To use Chrome to store passkeys, you need to have Chrome Sync enabled:<\/span><\/p>\n

\n
    \n
  1. \n
    <\/span><\/p>\n
    \n

    Open the Chrome browser.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  2. \n
    <\/span><\/p>\n
    \n

    Click on the hamburger button (three stacked dots in the upper right) and select Passwords & Autofill -> Google Password Manager.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

  3. \n
    <\/span><\/p>\n
    \n

    Enable “Use passkeys across your X devices,” where X is your type of devices (Windows, Apple, etc.). You will likely have a choice to use your Google account to sync data or the operating system’s native syncing mechanism (Microsoft OneDrive or Apple iCloud, for example).<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n

    Creating a Passkey: Microsoft 365 on Windows<\/h2>\n

    Microsoft’s passwordless technology is a little less integrated than Google’s or Apple’s passkey support. On Windows, logging into a site using passkeys through Windows Hello is <\/span>seamless with passkeys handled in the background<\/a><\/span>. On non-Windows systems, users must download the Microsoft Authenticator app to a supported device (such as an Android phone or iPhone) to log into Microsoft services using a second factor.<\/span><\/p>\n

    To use Windows to store passkeys:<\/span><\/p>\n

    \n
      \n
    1. \n
      <\/span><\/p>\n
      \n

      Download and install the Microsoft Authenticator app to your mobile device.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

    2. \n
      <\/span><\/p>\n
      \n

      Log into your Microsoft account (such as Microsoft Live or Microsoft 365) and go to Accounts -> Security. Under “Additional security,” turn on Passwordless account.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

    3. \n
      <\/span><\/p>\n
      \n

      To manage passkeys on Windows, go to Settings -> Accounts -> Passkey settings. All passkeys saved will be listed here.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n

      Creating a Passkey: PayPal on 1Password for Apple<\/h2>\n

      Apple users can manage their passkeys <\/span>through iCloud Keychain<\/a><\/span>, which synchronizes across all Apple platforms. However, third-party apps are another option. For users of the 1Password password manager, for example, passkeys are now <\/span>integrated into the information for each account<\/a><\/span> and easily accessible from a browser extension.<\/span><\/p>\n

      To use 1Password to store passkeys and access PayPal, for example:<\/span><\/p>\n

      \n
        \n
      1. \n
        <\/span><\/p>\n
        \n

        Download and install the 1Password application and the 1Password extension for your current browser(s).<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

      2. \n
        <\/span><\/p>\n
        \n

        Use your credentials to login to PayPal, saving the account to 1Password. Then, log out. (If you already have the PayPal credentials in 1Password, you can skip this step.)<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

      3. \n
        <\/span><\/p>\n
        \n

        Go to PayPal, and look for a link to “Create a passkey,” and click the link. Or, go to PayPal, open the 1Password extension, which should have a purple notification stating “Passkey available”. Click on the notification, and then click on “Use passkey.”<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n

      4. \n
        <\/span><\/p>\n
        \n

        You will have to log in again to have a passkey assigned to your account.<\/span><\/p>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n

        Recovering From a Lost Device<\/h2>\n

        The problem with tying online-account access to a device is that \u2014 if the device is lost, damaged, or stolen \u2014 the user has lost their access to those accounts. This critical problem is why Apple, Google and Microsoft collaborated on the passkey standard. By allowing passkeys to be synchronized through their cloud infrastructure, the companies can provide account recovery services \u2014 as can third-party providers, such as 1Password and others.<\/span><\/p>\n

        Still, a lost briefcase or backpack that has a person’s entire cloud-access stack \u2014 a laptop, phone and table, for example \u2014 could lead to a loss of access to their services. For that reason, the different ecosystems have different methods of recovering accounts and the keys associated with those accounts: Apple has <\/span>iCloud Keychain escrow<\/a><\/span>, Google allows users to <\/span>default to 2-step verification<\/a><\/span> through backup codes or a hardware security key, and 1Password allows account recovery <\/span>through its Emergency Kit process<\/a><\/span>.<\/span><\/p>\n

        Users should also consider purchasing a hardware token. Some passkey service providers allow the backing up of keys \u2014 such as the iCloud Keychain \u2014 to a security device, such as a hardware token. In addition, hardware tokens that support device-bound passkeys can be a backup method of accessing an account.<\/span><\/p>\n

        Passkeys users should run through the mental exercise of recovering their critical cloud accounts in the case of a lost device to ensure that they understand the process and know all the information necessary for recovery.<\/span><\/p>\n

        Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

        Passkeys gained momentum in 2023. In addition to the major<\/p>\n","protected":false},"author":12,"featured_media":2302,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-2301","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?fit=1200%2C800&ssl=1",1200,800,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?fit=300%2C200&ssl=1",300,200,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?fit=640%2C427&ssl=1",640,427,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?fit=640%2C427&ssl=1",640,427,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?fit=1200%2C800&ssl=1",1200,800,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?fit=1200%2C800&ssl=1",1200,800,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?fit=1024%2C683&ssl=1",1024,683,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/01\/getting-started-with-passkeys-one-service-at-a-time.jpg?fit=1200%2C800&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=2301"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2301\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/2302"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=2301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=2301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=2301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}