AiVibePasskeys
Passwordless credentials based on the FIDO2 and WebAuthn standards, in which a device holds a private key bound to a specific website or app and signs login challenges after the user unlocks it with a biometric or PIN.
When a user registers a passkey, the device or credential manager creates a public-private key pair for that service, and the service stores only the public key. At sign-in, the service sends a challenge, the user verifies locally with a fingerprint, face scan or device PIN, and the authenticator signs the challenge with the private key, which is never shared with the service. Because each passkey is bound to the service's domain, it cannot be used on a look-alike phishing site.
The underlying standards were developed by the FIDO Alliance and the W3C, and major operating systems, browsers and password managers support passkeys. Synced passkeys are backed up across a user's devices by a credential manager with end-to-end encryption, while device-bound passkeys stay on a single device or hardware security key, which some high-assurance environments require. Organisations adopt passkeys to reduce phishing, password resets and credential stuffing.
Passkeys provide phishing-resistant multi-factor authentication in a single step, since they combine possession of the device with local user verification. Deployment considerations include account recovery when devices are lost, support on shared or older devices, and policies on which credential managers are allowed. Because the service stores only public keys, a breach of its database does not expose credentials that could be used to sign in.
Key points
- Use public-key cryptography instead of shared secrets.
- Bound to the website's domain, so they resist phishing.
- Unlocked locally with a biometric or PIN that is not sent to the service.
- Can be synced across devices or bound to a single hardware key.
Where AiVibe comes in
AiVibe is ISO/IEC 27001:2022 certified, and its security services include vulnerability assessment and penetration testing, code security analysis (SAST, DAST, IAST, SCA), compliance gap analysis and 24/7 monitoring; AiVedha.ai runs more than 170 automated website security checks.