A reader writes in, asking:
“You have said, and I have read elsewhere also, that passkeys are ‘phishing resistant.’ I’m ready to believe that, because everybody ‘in the know’ says so, but I haven’t really been able to wrap my head around WHY that’s the case. Is that something you could write about?”
Broadly speaking, phishing happens in either of two ways:
- You somehow end up on a malicious website (one designed to look like your bank, email provider, etc.), and you don’t realize it’s not the real deal. So you enter your login credentials to sign in, and now the bad guy has collected those credentials.
- As part of a communication (e.g., a text or phone call from the bad guy, who convinces you that they work at your bank or some other place where you have an account), you are tricked into sharing your login credentials (e.g., sharing them by text or stating them over the phone).
Passkeys are inherently strong against both of those types of attacks.
Phishing via Malicious Website
Passkeys are domain-bound, which means that when you create a passkey, saved as a part of that passkey is the specific domain that it’s used for. For example, if you bank with Chase, and you create a passkey while signed in on Chase.com, that passkey is specifically bound to the domain Chase.com.
So if you someday unknowingly end up on a malicious website that is designed to look like Chase.com, your passkey simply won’t work. The “accidentally enter your login credentials into a malicious website” scenario simply doesn’t exist with a passkey in the way that it does with a password.
Note, however, that if you have a website for which you can sign in via passkey or via password, then just because you have a passkey doesn’t mean you’re now invulnerable to being tricked into entering your password into a malicious website.
But even still, the passkey provides some useful protection. If you normally sign in with a passkey, and one day that passkey does not load, do not assume that your passkey “isn’t working” and that you should enter your password instead. Rather, treat your passkey not loading as a valuable and critical signal that you might be on the wrong website. Rather than entering your password, it’s probably best to start over: in the location bar of your browser type the known URL of the website you’re intending to visit (or use a bookmark). To be clear, passkeys can sometimes fail to load for benign reasons, but the safe response is the same either way: re-navigate to the website via a known-safe method.
Phishing via Malicious Communication
In normal usage, the user doesn’t actually see the secret part of the passkey (i.e., the private key of the private/public key pair). It’s saved in your password manager (or on a security key such as a YubiKey). And when you click a button to log in with a passkey, all of the magic (i.e., your device accessing your private key, using it to create a digital signature, and sending that digital signature to the website you’re logging into) happens behind the scenes, out of the user’s view. The user doesn’t even have an easy way (or, in some cases, any way) to share the secret part. And if you don’t have a way to share it, you can’t be tricked into sharing it with a bad guy.
What is the Best Age to Claim Social Security?
Read the answers to this question and several other Social Security questions in my latest book:
 | Social Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less |
Disclaimer:Your subscription to this blog does not create a CPA-client or other professional services relationship between you and Michael Piper or between you and Simple Subjects, LLC. By subscribing, you explicitly agree not to hold Michael Piper or Simple Subjects, LLC liable in any way for damages arising from decisions you make based on the information available herein. Neither Michael Piper nor Simple Subjects, LLC makes any warranty as to the accuracy of any information contained in this communication. The information contained herein is for informational and entertainment purposes only and does not constitute financial advice. On financial matters for which assistance is needed, I strongly urge you to meet with a professional advisor who (unlike me) has a professional relationship with you and who (again, unlike me) knows the relevant details of your situation.
You may unsubscribe at any time by clicking the link at the bottom of this email (or by removing this RSS feed from your feed reader if you have subscribed via a feed reader).
