Digital passwords come under pressure as major tech companies move towards strengthened security measures

In a significant shift towards more secure login methods, tech giants like Google, Microsoft, and Apple are promoting passkeys as the primary alternative to passwords for computer security. These new login alternatives, which use public key cryptography, offer a phishing-resistant and password theft-immune approach to authentication.

What Are Passkeys?

Passkeys replace traditional passwords by leveraging biometric or device-based authentication, such as Face ID, Touch ID on Apple devices, or device PINs. The private key remains securely on the user’s device, while the public key is stored on the service side. Authentication happens without transmitting a password, significantly reducing risks of phishing and password leaks. Built on open standards like FIDO2 and WebAuthn, passkeys offer interoperability across platforms, including Apple’s iOS/macOS, Windows, and Android.

How Passkeys Compare in Security and User Experience

| Aspect | Passkeys (Google, Microsoft, Apple) | Traditional Passwords | |-----------------------------|----------------------------------------------------------|--------------------------------------------------| | Security | Phishing-resistant, private keys never exposed, immune to password theft or reuse attacks | Vulnerable to phishing, breaches, reuse, brute force | | User Experience | Seamless biometric or device-based login, no need to remember passwords, faster onboarding | Users must create, remember, and periodically update passwords; frequent resets and lockouts | | Cross-platform | Supported across multiple platforms; interoperability growing due to WebAuthn standard | Universal but often inconsistent user experience | | Recovery & Portability | Apple supports iCloud Keychain sync; Google offers password manager sync; some solutions allow device-to-device transfer | Passwords are manually managed; recovery depends on email or phone | | Adoption & Ecosystem | Growing; integrated deeply into operating systems and browsers by these tech giants, reducing friction | Long-established, but increasingly seen as outdated |

Besides passkeys, solutions like Duo Passwordless use platform authenticators, security keys, or push notifications to enable secure, password-free access for enterprise apps, integrating with Single Sign-On (SSO) providers for streamlined management.

Microsoft has been developing more secure login alternatives for years and predicts the end of the password era. Despite the efforts to end the password era, simple usernames and passwords are still widely used by many online services. The companies are promoting the use of access keys for password-free login methods, and the Fast Identity Online Alliance (FIDO), consisting of tech giants like Google, Microsoft, Apple, Amazon, and TikTok, is working on safer alternatives.

However, the human factor will remain at the heart of computer security, with users needing to take good care of security on their smartphones and devices. Eset's Benoit Grunemwald warns that smartphones and devices will be the most targeted in the future, and passwords are a common prize in data leaks from online platforms. A massive database of around 16 billion login credentials was discovered in June, highlighting the need for more secure login methods.

Setting up passkeys and restoring them if a PIN code is forgotten or a trusted smartphone is lost or stolen can be confusing for users. Nevertheless, the transition to an unfamiliar system like passkeys can provide a more secure, user-friendly, and interoperable alternative to passwords, addressing traditional password weaknesses while improving convenience for users across platforms.

Digital passwords come under pressure as major tech companies move towards strengthened security measures