Passkeys, a new password framework, and an update to Apple’s newest operating system, iOS 16, may be the long-awaited solution for password vulnerabilities and compromised credentials.
Passkeys are designed to generate a unique pair of secret codes called keys, one of which is a public key stored on the website. The other is a private key stored on your device. Although the two keys are related, one cannot be used to obtain the other.
Instead of a password, your device will ask you to authenticate using its biometric unlock mechanism when you try to log in to a website, which will scan either your face or your finger. Passkey’s functionality is deliberately limited to devices that support biometric data. You can also use iCloud to back up your keys and share them on your Apple devices.
Once your biometric data has been validated, your device will use your private key to verify your identity for the website by completing a complex mathematical challenge issued by the website. Your private key will never be transmitted to the website.
The website can only verify the answer from your device using the public key you generated during registration. No one can pretend to be you unless they have your private key securely stored on your device. If a website is compromised, cybercriminals will be unable to use the public key alone.
The sources for this piece include an article in TheConversation.