Apple is on a mission to get rid of traditional passwords for good, and a step towards that future is something called "Passkeys." Passkeys aim to entirely replace passwords in both apps and on the web and instead use either your finger or face as the password.
Passkeys are part of iOS 16 and macOS Ventura but also work on non-Apple devices and platforms such as Android and Windows. Apple's goal with Passkeys is to eliminate the need for users to ever type out, remember, or use a password again.
There are two scenarios for Passkeys: when you're using an Apple device and when you're on a Windows or Android device.
On an Apple Device
When you go to a website on your iPhone or iPad running iOS 16 or a Mac on macOS Ventura that supports Passkeys, the website will not prompt you to enter a password as you may expect it to. Instead, you'll simply be asked to authenticate with Touch ID or Face ID.
On a Windows or Android Device
On non-Apple devices, when you go to a website that supports Passkeys, you'll be asked to scan a QR code with your iPhone and then proceed to use Touch ID or Face ID as your actual password.
Passkeys will be more widely supported by apps and websites when iOS 16 and macOS Ventura are released to all users this fall, but there are already some websites that support Passkeys. Here are just a few apps and websites that are starting to roll out support:
eBay
Best Buy
Cloudflare
Microsoft
Nvidia
PayPal
Carnival
In an interview earlier this month, Apple's director of platform product marketing Kurt Knight said, "This isn't a future dream to replace passwords. This is something that's going to be a road to completely replace passwords, and it's starting now."
Passkeys is just one of several new changes and features coming to iOS 16 and macOS Ventura which you can learn about in our respective roundups.
That is just a cheap trick be Apple to make it more difficult to leave the Apple ecosystem and switch to Android, as long as you still need an iPhone in order for your Passkey to work on a Windows device. Hacking a good password is virtually impossible. Even if you only use nunbers and lowercase letters, there are 36 combinations for each letter of the password. So to more letters already makes it 1000 times more diffictult to hack.
Hacks usually happen at the server level and not at the user level. When millions of passwords for Ebay or Yahoo were hacked, Passkey would not have prevented that.
Sure, passkeys cannot prevent a database from being accessed by an attacker. The important difference is that when passkeys are leaked your account is not compromised because unlike passwords they use asymmetric cryptography and are also unique to every website.
Please do not spread misinformation about passkeys if you do not have a clue what you are talking about ...
That is just a cheap trick be Apple to make it more difficult to leave the Apple ecosystem and switch to Android, as long as you still need an iPhone in order for your Passkey to work on a Windows device. Hacking a good password is virtually impossible. Even if you only use nunbers and lowercase letters, there are 36 combinations for each letter of the password. So to more letters already makes it 1000 times more diffictult to hack.
Hacks usually happen at the server level and not at the user level. When millions of passwords for Ebay or Yahoo were hacked, Passkey would not have prevented that.
Actually, the passkeys will utilize an open standard so they can be migrated between systems AFAIK. Also, passkeys or even passphrases are often more suitable options to stronger passwords - the latest NIST recommendations and guidelines are a good read on the matter.
These days, obtaining password via phishing is much more common compared to larger password leaks from companies. Personal data is leaked more often, certainly, passwords, not that much.
For those asking how this works, here's a simplified explanation based on my understanding from reading and watching the online resources about it.
To register on a new site, say widget.com [LIST=1] * You go widget.com and navigate to its new-account creation page * Type in what you want your username to be and then click "create account" * Your phone will bring up a system sheet confirming you want to create a credential for widget.com. After you confirm, the phone will create a site-specific credential token (called "passkey" in FIDO parlance), the security of which is based on public-key encryption. * The phone will store the token and private-key portion of the token on your iCloud Keychain. It will share the public-key portion of the token with widget.com so it can save it on their server.
Whenever you visit widget.com in the future, Safari will know you have a saved credential for the site and will confirm you'd like to login, similar to how it works today for traditional passwords saved in your keychain, including you proving you have rightful access to your keychain (Face ID, passkey, etc...). But instead of a password, Safari will present the passkey (token) to the site (which it already has stored on their server to compare), then verify you're the rightful owner of the token by proving to the site that your phone has the private key associated with the token (challenge/response).
This is an improvement over passwords because there is no password to be stored on a server or presented for each site, which reduces the attack surface of your credentials. It also solves the problem of weak user passwords, or users reusing their password across multiple sites.
That is just a cheap trick be Apple to make it more difficult to leave the Apple ecosystem and switch to Android, as long as you still need an iPhone in order for your Passkey to work on a Windows device. Hacking a good password is virtually impossible. Even if you only use nunbers and lowercase letters, there are 36 combinations for each letter of the password. So to more letters already makes it 1000 times more diffictult to hack.
Hacks usually happen at the server level and not at the user level. When millions of passwords for Ebay or Yahoo were hacked, Passkey would not have prevented that.
If you even bothered to read the article, you'd learn this is not an apple thing.
And the rest of your post just underlines that you have zero idea how it works
As previously rumored, the next-generation iPhone 15 Pro and iPhone 15 Pro Max will feature a unified volume button and a mute button, according to leaked CAD images shared in a video on the Chinese version of TikTok and posted to Twitter by ShrimpApplePro.
Instead of separate buttons for volume up and volume down, the iPhone 15 Pro models are expected to have a single elongated button for...
A first-generation iPhone still sealed inside its box sold for $54,904 at auction, which is more than $54,000 over the original $599 price tag of the device when it was released in 2007.
The original iPhone was put up for sale by RR Auction on behalf of a former Apple employee who purchased it back when it first came out. Back in February, an original, sealed iPhone sold for over $63,000,...
While year-over-year iPhone upgrades are not always groundbreaking, new features can begin to stack up over multiple generations. For example, the iPhone 15 Pro will be a notable upgrade for those who still have a three-year-old iPhone 12 Pro.
If you are still using an iPhone 12 Pro and are considering upgrading to the iPhone 15 Pro when it launches later this year, we have put together a...
Apple's high-end iPhone models have started at $999 in the U.S. since they first launched back in 2017 with the iPhone X, but could this finally be the year that starting price sees an increase?
This week also saw some more rumors about Apple's upcoming headset and the company's explorations in the booming AI industry as well as the release of a new round of beta updates, so read on for all...
The iPhone 15 Pro Max will have the thinnest bezels of any smartphone, beating the record currently held by the Xiaomi 13. That's according to the leaker known as "Ice Universe," who has divulged accurate information about Apple's plans in the past.
Both iPhone 15 Pro models are expected to have thinner, curved bezels compared to the iPhone 14 Pro, potentially resulting in an Apple...
While the iPhone 15 lineup is around six months away, there have already been plenty of rumors about the devices. Many new features and changes are expected for the iPhone 15 Pro models in particular, including a titanium frame and more.
Below, we have recapped 11 features rumored for iPhone 15 Pro models that are not expected to be available on the standard iPhone 15 and iPhone 15 Plus:A17...
Apple says iOS 16.4 is coming in the spring, which began this week. In his Sunday newsletter, Bloomberg's Mark Gurman said the update should be released "in the next three weeks or so," meaning a public release is likely in late March or early April.
iOS 16.4 remains in beta testing and introduces a handful of new features and changes for the iPhone. Below, we have recapped five new features ...
Apple on January 23 released iOS 16.3, delivering support for Security Keys for Apple IDs, changes to Emergency SOS functionality, support for the second-generation HomePod, and more.
Top Rated Comments
Please do not spread misinformation about passkeys if you do not have a clue what you are talking about ...
This is the standard reply when Apple introduces something new.
When it’s a feature Android already had (even if worse), the common reply is “iNnOVAtion”.
These days, obtaining password via phishing is much more common compared to larger password leaks from companies. Personal data is leaked more often, certainly, passwords, not that much.
To register on a new site, say widget.com
[LIST=1]
* You go widget.com and navigate to its new-account creation page
* Type in what you want your username to be and then click "create account"
* Your phone will bring up a system sheet confirming you want to create a credential for widget.com. After you confirm, the phone will create a site-specific credential token (called "passkey" in FIDO parlance), the security of which is based on public-key encryption.
* The phone will store the token and private-key portion of the token on your iCloud Keychain. It will share the public-key portion of the token with widget.com so it can save it on their server.
Whenever you visit widget.com in the future, Safari will know you have a saved credential for the site and will confirm you'd like to login, similar to how it works today for traditional passwords saved in your keychain, including you proving you have rightful access to your keychain (Face ID, passkey, etc...). But instead of a password, Safari will present the passkey (token) to the site (which it already has stored on their server to compare), then verify you're the rightful owner of the token by proving to the site that your phone has the private key associated with the token (challenge/response).
This is an improvement over passwords because there is no password to be stored on a server or presented for each site, which reduces the attack surface of your credentials. It also solves the problem of weak user passwords, or users reusing their password across multiple sites.
This will totally change how we authenticate online.
And the rest of your post just underlines that you have zero idea how it works