title: Passkeys (passwordless logins)

excerpt: After a longer break from posting, due to being too busy with other things, I hope to post more regularly the next weeks/months. Starting with this Passkeys intro, where I’ve summarized Passkeys and their advantages & disadvantages for you.

coverImageInfo: Selfmade with draw.io

date: "2023-11-15T21:00Z"

source: https://adriankast.notion.site/Passkeys-passwordless-logins-147548ee271d47eaa25cb96b732ed1eb?pvs=4

After a longer break from posting, due to being too busy with other things, I hope to post more regularly the next weeks/months. Starting with this Passkeys intro, where I’ve summarized Passkeys and their advantages & disadvantages for you.

How Passkeys work

If you have never heard of Passkeys before, Google has a quite brief video that really gives a good first idea of them:

Understand passkeys in 4 minutes

So to summarize the basic mechanism, also shown in the figure below:

• Instead of a Password a public/private key pair is generated during registration

• The public key is stored at the Website you want to use, the private key on your device

  

This will probably sound very familiar at least for the developers among us, since using SSH keys to connect to remote servers or for git is something we do often. So what is the buzz all about?

The “real” gamechanger with Passkeys is that the mechanism now becomes more convenient and user friendly. What do I mean with that?

• No technical skills (or CLI knowledge) are required to set Passkeys up, you never actually see the keys
• It is considered that the keys are intended to be synced across devices (like with a Password Manager), so you can use the same logins on all you devices
• It is even possible to share single logins with other local devices where you want to login (like a work computer or your friends tablet) by scanning a QR code.

So Passkeys are kind of SSH keypairs on steroids. For a better overview you find both sharing mechanisms illustrated in the next figure.