Biometrics, Security Keys and Passkeys

Passwords were invented for a different era, and everyone, including security experts, finds them tiresome and fragile. A new generation of sign-in methods based on fingerprints, faces, security keys and "passkeys" aims to replace them with something both easier and safer. This lesson explains how they work in plain language, where they shine, and what limits to keep in mind.

You have already built two layers: strong unique passwords in a manager and a second factor. Here we look at what is coming next, and which parts you can already use today.

Biometrics: your body as a key

Biometrics uses a physical characteristic to recognize you: a fingerprint, the shape of your face, sometimes an iris or a voice. You use it every day when you unlock your phone with a touch.

Two points are often misunderstood:

• The device usually does not store a photo of your finger or face. It stores a mathematical representation, inside a protected area of the hardware. On modern phones and computers this data stays on the device and is not sent to the apps you use or to a website.
• Biometrics unlock a local secret; they are not the secret itself. When you touch the sensor, the device verifies you locally and then uses a secure cryptographic key stored inside it to prove your identity.

Strengths of biometrics

• Convenience: nothing to remember, very quick. That convenience encourages people to use a longer device password in the first place, since they type it rarely.
• You cannot forget it at home.
• Hard to guess remotely: an attacker on the other side of the world cannot "try" a fingerprint over the internet.

Limits of biometrics

• You cannot change it. If a password leaks, you change it. You cannot change your fingerprint. This is why the biometric data should never leave the device or be stored in a central database you do not trust.
• It is not secret. You leave fingerprints on glasses and your face is visible everywhere. Sophisticated spoofing is possible in theory, although it is much harder than guessing a weak password.
• Legal and physical pressure. Someone can force you to put your finger on the sensor, and legal rules about compelled unlocking differ between countries and between biometrics and passcodes. If you may face that situation (for example, crossing a border or a demonstration), many devices have a quick way to temporarily disable biometric unlock and require the passcode.
• False matches and failures: wet fingers, a scar, a mask or a change of appearance can make recognition fail, so a fallback code is always required.

The problem with passwords

Even with a manager and two-factor authentication, one weakness remains: a password is a shared secret. You and the website both know it. This means that it can be phished (you type it into a fake site), stolen in a breach (the website holds it, even hashed) or intercepted. The new generation of methods removes the shared secret.

FIDO2, WebAuthn and passkeys: the idea

FIDO2 is an open standard, developed by an industry alliance, for strong sign-in without passwords. Part of it, WebAuthn, is how websites talk to your browser and device; you will find it documented on developer.mozilla.org if you are curious. A passkey is the friendly name for a credential that uses this standard.

It works with public-key cryptography, which can be pictured with a padlock analogy:

1. When you create a passkey for a website, your device produces a pair of keys: a public key (like an open padlock that anyone can have) and a private key (the only key that can open that padlock).
2. The website receives and stores only the public key. The private key never leaves your device (or your secure sync vault).
3. When you sign in, the website sends a challenge, and your device signs it with the private key, after you confirm with your fingerprint, face or device code.
4. The website checks the signature with the public key. Done.

What does this change?

• Nothing secret is stored on the website. If the website is breached, the attackers only steal public keys, which are useless to sign in.
• No phishing. A passkey is bound to the real website address. On a look-alike site, your device simply has no matching key and nothing is offered. You cannot be tricked into handing it over, because there is nothing to type.
• No reuse and no weak choice, because each passkey is unique and generated by the device.
• Faster sign-in: one touch or glance instead of typing a password and a code.

Device-bound keys and synced passkeys

There are two practical flavors:

• Hardware security keys (device-bound): the private key lives inside a small physical key and cannot be copied out. This is the strictest option and is excellent for the most critical accounts. Buy two and register both.
• Synced passkeys: the private key is stored in your phone, computer or password manager, and synchronized with end-to-end encryption between your devices, so losing one device does not lock you out. It is much more convenient, with a slightly broader trust surface: the safety of your passkeys now depends on the safety of the account that syncs them, which should itself be protected with a strong passphrase and a second factor.

What to do in practice today

1. Protect your devices with a strong passcode and enable fingerprint or face unlock for daily convenience.
2. Create passkeys where they are offered, starting with your email, your main cloud account and any service that proposes them. Look for options like "create a passkey" or "sign in with a passkey" in the account security settings.
3. Keep a fallback: the old password and your recovery codes remain useful during the transition, since many sites still require them.
4. Consider a security key for your most critical accounts, and store the spare safely.
5. Remember you are in transition. Not all services support passkeys, so your password manager and your two-factor authentication remain essential for years to come.

Your turn

Exercise. Look at your five most critical accounts. For each, check whether the service offers a passkey or a security-key option. Create a passkey for at least one of them, and test signing in with it.

See a solution

1. Open the security settings of the account and look for "passkeys", "security keys" or "passwordless sign-in".
2. Follow the wizard: your device asks you to confirm with your fingerprint, face or device code, and the passkey is saved to your device or password manager.
3. Sign out and try the passkey sign-in. Check that you can still use your fallback (password plus second factor) if needed.
4. Note in your Security Notebook which accounts have a passkey and which do not support it yet.

If none of your accounts supports passkeys yet, no problem: note it, and re-check in a few months. Adoption is growing quickly.

Add to your Security Notebook

Complete section 2 with a "sign-in methods" overview: for each critical account, the factor in use (passkey, app, SMS), where the recovery codes are kept, and the next upgrade to make. Add one sentence about whether you want to buy a pair of security keys.

Your accounts are now much better protected. In Chapter 3, we turn to the devices that hold them: updates, encryption, backups and your phone.