Do you need passkeys in your applications?
AI is changing the landscape
With the rise of AI, phishing attacks are becoming more effective and more accessible. Attack tactics are now easier to replicate and run much faster than when a human carried them out manually.
What is a passkey?
A passkey is a modern alternative to passwords. It uses cryptography and is designed so you can sign in to your accounts without having to remember or type a password. Passkeys rely on the same security mechanisms already built into your phone or computer, like facial recognition, a fingerprint, or a PIN. That authentication only works on the device where it was set up.
The main advantage is that a passkey can’t accidentally be handed over to a fake website, unlike a password. That significantly reduces the risk of phishing.
How do they work?
With passkeys in place, when you sign in to your company’s CRM (for example), you’d do it with your PIN or fingerprint instead of typing a password.
This technology is natively supported on Windows, macOS, iOS, Android, and all major browsers.
Passkeys in your web applications
The industry is moving toward a model where passwords will be needed less and less.
Whether you need to implement passkeys right now depends on a few factors, such as:
- The technology your applications were built with.
- The sensitivity of the data they store and the operations they perform.
- Whether another layer of protection already exists, like two-factor authentication.
- Whether you need to meet a specific security compliance requirement.
- Your users’ profile. 15 internal employees is not the same as 8,000 customers, and technical skill can vary a lot from one industry to another.
- Your budget.
To make the best decision, you should evaluate the need with your team or IT provider, but here’s a quick assessment that can help.
How much of a priority is implementing passkeys in my systems?
1. Does your system store sensitive information (financial, medical, legal, personal, or strategic for the business)?
This is the most important factor. The more valuable the information, the greater the impact of unauthorized access.
2. Can your systems be accessed from the internet (remote employees, customers, suppliers, or branch offices)?
A system exposed to the internet has a much larger attack surface than one that’s only accessible from an internal network.
3. Have you experienced a phishing incident, credential theft, or unauthorized access?
A previous incident means the threat is no longer theoretical, and it’s worth strengthening authentication.
4. Do your users tend to reuse, share, or choose weak passwords?
Passwords are still one of the most vulnerable points in many systems. Passkeys eliminate a large part of that risk.
5. Do your users frequently forget their passwords or request resets?
Besides improving security, passkeys reduce password-recovery requests and simplify access.
6. Do these systems already have two-factor authentication (MFA)?
Not having MFA increases current risk. If it’s already in place, the urgency to migrate to passkeys goes down, although they still offer advantages against phishing.
Interpretation
Answer the questions above to get your result.
Low priority.
Current risks seem reasonably under control. Implementing passkeys could be a future improvement, but there are probably more important investments right now.
Medium priority.
There are risk factors that justify evaluating an implementation. It’s worth analyzing the cost, technology compatibility, and impact on users.
High priority.
Passkeys would likely bring a meaningful improvement in both security and user experience. It’s worth including them in the system’s roadmap.
Highly recommended.
The risk of relying solely on passwords is high. If the system’s technology allows it, implementing passkeys should be treated as a priority.