\u201cYou have said, and I have read elsewhere also, that passkeys are \u2018phishing resistant.\u2019 I\u2019m ready to believe that, because everybody \u2018in the know\u2019 says so, but I haven\u2019t really been able to wrap my head around WHY that\u2019s the case. Is that something you could write about?\u201d<\/p>\n<\/blockquote>\n
Broadly speaking, phishing happens in either of two ways:<\/p>\n
- \n
- You somehow end up on a malicious website (one designed to look like<\/em> your bank, email provider, etc.), and you don\u2019t realize it\u2019s not the real deal. So you enter your login credentials to sign in, and now the bad guy has collected those credentials.<\/li>\n
- As part of a communication (e.g., a text or phone call from the bad guy, who convinces you that they work at your bank or some other place where you have an account), you are tricked into sharing your login credentials (e.g., sharing them by text or stating them over the phone).<\/li>\n<\/ol>\n
Passkeys are inherently strong against both of those types of attacks.<\/p>\n
Phishing via Malicious Website<\/h3>\n
Passkeys are domain-bound<\/strong>, which means that when you create a passkey, saved as a part of that passkey is the specific domain that it\u2019s used for. For example, if you bank with Chase, and you create a passkey while signed in on Chase.com, that passkey is specifically bound to the domain Chase.com.<\/p>\n
So if you someday unknowingly end up on a malicious website that is designed to look<\/em> like Chase.com, your passkey simply won\u2019t work. The \u201caccidentally enter your login credentials into a malicious website\u201d scenario simply doesn\u2019t exist with a passkey in the way that it does with a password.<\/p>\n
Note, however, that if you have a website for which you can sign in via passkey\u00a0or<\/em> via password, then just because you\u00a0have<\/em> a passkey doesn\u2019t mean you\u2019re now invulnerable to being tricked into entering your password into a malicious website.<\/p>\n
But even still, the passkey provides some useful protection. If you normally sign in with a passkey, and one day that passkey does not load, do not assume that your passkey \u201cisn\u2019t working\u201d and that you should enter your password instead. Rather, treat your passkey not loading as a valuable and critical signal<\/em> that you might be on the wrong website. Rather than entering your password, it\u2019s probably best to start over: in the location bar of your browser type the known URL of the website you\u2019re intending to visit (or use a bookmark). To be clear, passkeys can<\/em> sometimes fail to load for benign reasons, but the safe response is the same either way: re-navigate to the website via a known-safe method.<\/p>\n
Phishing via Malicious Communication<\/h3>\n
In normal usage, the user doesn\u2019t actually see<\/em> the secret part of the passkey (i.e., the private key of the private\/public key pair). It\u2019s saved in your password manager (or on a security key such as a YubiKey). And when you click a button to log in with a passkey, all of the magic (i.e., your device accessing your private key, using it to create a digital signature, and sending that digital signature to the website you\u2019re logging into) happens behind the scenes, out of the user\u2019s view. The user doesn\u2019t even\u00a0have<\/em> an easy way (or, in some cases, any<\/em> way) to share the secret part. And if you don\u2019t have a way to share it, you can\u2019t be tricked into sharing it with a bad guy.<\/p>\n
What is the Best Age to Claim Social Security?<\/h3>\n
Read the answers to this question and several other Social Security questions in my latest book:<\/p>\n
\n
\n \n<\/colgroup>\n \n ![\"\"](\"https:\/\/www.obliviousinvestor.com\/wp-content\/uploads\/2014\/04\/NewBook8CoverTiltedScaled2.png\" "\\"Book8FrontCovertilted150x200\\"")
<\/a><\/td>\nSocial Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less<\/strong><\/em>\n - As part of a communication (e.g., a text or phone call from the bad guy, who convinces you that they work at your bank or some other place where you have an account), you are tricked into sharing your login credentials (e.g., sharing them by text or stating them over the phone).<\/li>\n<\/ol>\n