Safer, but is it simpler?
Oct 23rd, 2024 by Jesper Kråkhede
Passkeys are safer than passwords. No discussion. But are they simpler? That depends on who you ask, and when.
For the daily logon, yes. A fingerprint or a glance at the camera is faster than typing a password and waiting for a code.
But the edge cases are harder. What happens when you lose your phone? When you get a new laptop? When you want to log on from someone else´s computer? When the passkey is synced in one ecosystem, but you use devices from another? For a technically curious person, these are small puzzles. For many users, they are a reason to call the help desk, or to give up and fall back to the password.
For organisations, there are more questions. Which passkeys should be allowed: synced ones in a personal cloud account, or only device bound ones that the organisation controls? How do you register them securely, and how do you recover when a user loses all of them? Recovery is where attackers will go next.
So for management: Passkeys should be part of your strategy, especially for admins and for everyone with access to sensitive data. But plan the whole lifecycle, not just the logon. Registration, recovery, lost devices and support. And invest in helping the users through the change. A security improvement that users avoid isn´t an improvement.
Simple for the user requires a lot of work from the organisation.