The document explains the concept of passkeys as a safer and more convenient alternative to traditional passwords, utilizing public-key cryptography for authentication. It details how passkeys work, their advantages over passwords, recovery processes, and various use cases, including login options, reauthentication, possession-based authentication, and cross-platform interoperability. Additionally, it highlights the transition towards passwordless authentication and promotes MojoAuth as a solution for implementing secure, password-free systems.

2. ● What is Passkey?
● Passwords vs Passkeys
● How Passkeys are Safer than Passwords?
● How does Passkey Authentication Work?
● Passwordless Authentication with Passkeys
● How to Recover the Passkey?
● What are the Use Cases of Passkeys?
Table of contents

3. What is Passkey?
Passkeys work on straightforward identity verifications, like fingerprint scans, facial
recognition, PIN, or swipe patterns. Passkey authentication is safer and easy to use for
users compared to password-based authentication. Also, here is a dedicated blog on
passkeys that talks about their basics, benefits, working, and configuration.
Now that you have a basic understanding of passkeys, let’s discuss how it differs from a
typical password, passkey authentication workflow, and some examples of how they could
be used.

4. Passwords vs Passkeys

5. How Passkeys are Safer than Passwords?
Passkeys are way safer and more convenient than passwords when put on a comparison
scale. Passkey technology uses two cryptographic keys, one of which is stored in the
application server and the other in a secure wallet. During the passkey-based authentication
process, the application verifies the login using the public key that is stored on the server as
long as users have the matching private key. Authentication is either accepted or rejected,
depending on whether the match is verified.
● Passwords are generated by users and prone to attacks like credential stuffing,
phishing, dictionary password attacks, etc.
● Passkeys are system generated and safe against common password-based attacks.
In case when a hacker gets unauthorized access to the server, public keys alone won’t have
any purpose because the private key is stored in a secure wallet and is never divulged. This
public-key cryptography process reduces the likelihood of security breaches or password-
based attacks targeting password servers or databases.

6. How does Passkey Authentication Work?

7. Passwordless Authentication with Passkeys
Passkey is a passwordless authentication system built on cryptography that enables web
applications to use registered devices (mobile phones, tablets, smart cards, etc.) as
authentication factors, thereby streamlining and securing user authentication.
As a result of this new standard, any web application can now use these authenticators to
securely authenticate users when running in a browser that supports WebAuthn. In addition,
implementing passwordless authentication with passkeys results in:
● Preventing password-based attacks like phishing and credential stuffing
● Eliminating password management costs
● Improving user experience

8. How to Recover the Passkey?
In case of unavoidable situations like losing a device that was originally used for setting up a
passkey, users can easily reset passkeys for their new device.
For instance, if the user has configured pattern or fingerprint-based authentication on their
old device that is lost, they can easily reset passkey for the specific application on any new
device. However, users must have access to secure wallet where the private key was
stored. Following are the steps to reset the passkey:
● User should open the passkey-enabled application, navigate ahead for settings and
search for the passkey reset option.
● Next, the user should confirm identity by completing a verification for a passkey reset.
● Then, follow the on-screen instructions to set a new passkey for their new device.

9. What are the Use Cases of Passkeys?
1. Embedding passkey-based login
options
When an application has a Login with
passkey feature enabled on its login page,
users can quickly select an account
associated with it and then carry out simple
verification procedures, just as unlocking the
screen or performing biometric scanning to
log in. Such user-friendly procedures, which
users are already accustomed to in their daily
lives, empower users to undergo seamless
authentication experiences instead of filling in
the typical login boxes, as with password-
based authentications.
2. Reauthentication factor
Reauthentication has become common practice
for the application ensuring security while
performing sensitive actions. Passkeys can be
effectively used as a reauthentication factor that
adds an extra degree of security to the ongoing
process. For instance, if the user is already
signed in to a transaction app, the app still
requests another authentication (passkey) before
doing a critical operation like transferring money
or updating account details.

10. Cont..
3. Possession-based authentication
Passkeys authenticate users with their
possessions like mobile phones, USBs, and
smartcards, which makes the process more
convenient and quick compared to password-
based authentication. With passkeys, user
credentials can be verified using either an in-
built authenticator (biometric device), an
external or roaming authenticator (mobile
phones), or an authenticator that is plugged in
(USB or smartcard).
4. Cross-platform interoperability
Passkey technology possesses cross-
platform interoperability features, which
allow a passkey on one device to sign into
any nearby device, irrespective of the
operating system or device. For instance,
the Chrome application on a computer
can be authenticated using a passkey
stored on an Android device, and vice
versa. As long as the Android device is
near the computer, the user can approve
the authentication on the phone with just a
single touch or tap.

11. Wrapping Up!
Passwordless authentication has already begun making a great change toward a secure
future free from password-based cyber attacks and hacking while ensuring a smooth user
experience. It is apparent that the Passwordless initiative offers a variety of secure
techniques to authenticate, including passkeys, to circumvent cyberattacks.

12. Thank You!
Are you looking to go passwordless? Well, MojoAuth enables you to design a password-free
authentication solution that any enterprise can utilize to streamline the authentication
process and lower client security concerns. Visit https://mojoauth.com/ for more information.