Passkeys - A More Secure Alternative to Passwords

What Happened

At CYBERUK 2026 in Glasgow, the National Cyber Security Centre (NCSC) announced a significant shift towards recommending passkeys as a replacement for traditional passwords. This change is based on extensive research and collaboration with various stakeholders, including technology vendors and the FIDO Alliance.

Why This Matters

Passkeys are designed to be more secure and user-friendly compared to traditional multi-factor authentication (MFA) methods. The NCSC's analysis concluded that traditional MFA methods, such as SMS codes and email verifications, are inherently vulnerable to phishing attacks. In contrast, FIDO2 credentials, which include passkeys, offer enhanced protection against common credential attacks.

How Passkeys Work

Passkeys function by using cryptographic keys that are securely stored on devices. When logging in, these keys are used in conjunction with user verification methods, effectively creating a multi-factor authentication system without the vulnerabilities associated with traditional methods. This means that even if an attacker intercepts a login attempt, they cannot easily reuse or relay the credentials.

Addressing Concerns

Several concerns about passkeys have been raised, including:

• Synchronization: Passkeys can sync across devices using cloud services, similar to how password managers operate. The key is ensuring the sync account is secure.
• Multi-Factor Authentication: Passkeys qualify as multi-factor authentication when user verification is required, combining something the user has with something they know or are.
• Effectiveness of Traditional MFA: While traditional MFA can be effective, it remains vulnerable to phishing attacks, which passkeys are designed to eliminate.

Getting the Most Benefit

For passkeys to be effective, users must implement them sensibly. This includes ensuring the security of devices and credential managers, as well as having clear recovery options. The NCSC emphasizes that even under realistic conditions, passkeys provide stronger protection than traditional MFA methods.

Conclusion

The NCSC strongly recommends that individuals and organizations adopt passkeys wherever possible. This shift towards phishing-resistant authentication represents a significant opportunity to enhance security and reduce the risk of cyber compromises. As technology matures and standards become established, the transition to passkeys is not just beneficial but essential for improving online security.