Apple Wants Passkeys to Replace Passwords: Here's Where You Can Try Them Out Now With iOS 16

That is just a cheap trick be Apple to make it more difficult to leave the Apple ecosystem and switch to Android, as long as you still need an iPhone in order for your Passkey to work on a Windows device. Hacking a good password is virtually impossible. Even if you only use nunbers and lowercase letters, there are 36 combinations for each letter of the password. So to more letters already makes it 1000 times more diffictult to hack.

Hacks usually happen at the server level and not at the user level. When millions of passwords for Ebay or Yahoo were hacked, Passkey would not have prevented that.

Sure, passkeys cannot prevent a database from being accessed by an attacker. The important difference is that when passkeys are leaked your account is not compromised because unlike passwords they use asymmetric cryptography and are also unique to every website.

Please do not spread misinformation about passkeys if you do not have a clue what you are talking about ...

This sounds really good and a nice evolution on passwords.

That is just a cheap trick be Apple to make it more difficult to leave the Apple ecosystem

This is the standard reply when Apple introduces something new.

When it’s a feature Android already had (even if worse), the common reply is “iNnOVAtion”.

That is just a cheap trick be Apple to make it more difficult to leave the Apple ecosystem and switch to Android, as long as you still need an iPhone in order for your Passkey to work on a Windows device. Hacking a good password is virtually impossible. Even if you only use nunbers and lowercase letters, there are 36 combinations for each letter of the password. So to more letters already makes it 1000 times more diffictult to hack.

Hacks usually happen at the server level and not at the user level. When millions of passwords for Ebay or Yahoo were hacked, Passkey would not have prevented that.

Actually, the passkeys will utilize an open standard so they can be migrated between systems AFAIK. Also, passkeys or even passphrases are often more suitable options to stronger passwords - the latest NIST recommendations and guidelines are a good read on the matter.

These days, obtaining password via phishing is much more common compared to larger password leaks from companies. Personal data is leaked more often, certainly, passwords, not that much.

For those asking how this works, here's a simplified explanation based on my understanding from reading and watching the online resources about it.

To register on a new site, say widget.com
[LIST=1]
* You go widget.com and navigate to its new-account creation page
* Type in what you want your username to be and then click "create account"
* Your phone will bring up a system sheet confirming you want to create a credential for widget.com. After you confirm, the phone will create a site-specific credential token (called "passkey" in FIDO parlance), the security of which is based on public-key encryption.
* The phone will store the token and private-key portion of the token on your iCloud Keychain. It will share the public-key portion of the token with widget.com so it can save it on their server.

Whenever you visit widget.com in the future, Safari will know you have a saved credential for the site and will confirm you'd like to login, similar to how it works today for traditional passwords saved in your keychain, including you proving you have rightful access to your keychain (Face ID, passkey, etc...). But instead of a password, Safari will present the passkey (token) to the site (which it already has stored on their server to compare), then verify you're the rightful owner of the token by proving to the site that your phone has the private key associated with the token (challenge/response).

This is an improvement over passwords because there is no password to be stored on a server or presented for each site, which reduces the attack surface of your credentials. It also solves the problem of weak user passwords, or users reusing their password across multiple sites.

I said at the time that this was the biggest announcement at the keynote, and I still believe that.

This will totally change how we authenticate online.

That is just a cheap trick be Apple to make it more difficult to leave the Apple ecosystem and switch to Android, as long as you still need an iPhone in order for your Passkey to work on a Windows device. Hacking a good password is virtually impossible. Even if you only use nunbers and lowercase letters, there are 36 combinations for each letter of the password. So to more letters already makes it 1000 times more diffictult to hack.

Hacks usually happen at the server level and not at the user level. When millions of passwords for Ebay or Yahoo were hacked, Passkey would not have prevented that.

If you even bothered to read the article, you'd learn this is not an apple thing.

And the rest of your post just underlines that you have zero idea how it works