Why Passkeys are the future

WEBVTT
00:00:00.119 --> 00:00:07.990
There will be a time when we will wonder how we ever use passwords, and pass keys are the beginning of the end of passwords.
00:00:09.960 --> 00:00:13.730
Honestly, I don't really know anything about pass keys.
00:00:14.560 --> 00:00:15.746
Let me introduce you to that.
00:00:15.746 --> 00:00:19.231
Pass keys are an alternative concept to passwords.
00:00:19.231 --> 00:00:21.748
Let's first talk about the problem with passwords.
00:00:21.748 --> 00:00:28.126
Passwords tend to be insecure because we mostly imagine new passwords and not everyone's really great at this.
00:00:28.126 --> 00:00:36.802
They're replayable, because when someone steals your password, they can just use it an infinite amount of times, unless you're using two-factor authentication.
00:00:36.802 --> 00:00:39.271
Then also, they are stored on a website.
00:00:39.271 --> 00:00:52.848
It can be reverse engineered, and the worst part of it is that one of the biggest factors of hacking actually is social engineering, where you just try to convince someone to simply give you your passwords, and one of the most well-known things is phishing.
00:00:52.848 --> 00:01:08.531
Right, when you send someone an email, it looks like that email form your service provider, but actually it's not, and people just enter their passwords and pass keys kind of solve all these problems and, on top of what I really love about it, it's a much, much nicer use experience.
00:01:08.531 --> 00:01:10.103
So I'm excited.
00:01:11.629 --> 00:01:12.311
What's the solution?
00:01:12.311 --> 00:01:13.887
Pass keys how do they work?
00:01:13.887 --> 00:01:17.448
Maybe I should just show it by going on this example website, passkeys.
00:01:17.448 --> 00:01:18.171
io.
00:01:18.171 --> 00:01:24.828
I don't have an account here, so let me just create my account with my email address and I'll click Save a pass key.
00:01:24.828 --> 00:01:36.310
It will ask me what kind of device I want to authenticate with so either my computer or it could also be my iPhone or an Android phone and then create a pass key for this device.
00:01:36.310 --> 00:01:41.832
What this will do is it will actually create a private key on my computer.
00:01:41.832 --> 00:01:52.210
This private key will be protected by biometric data, in a sense that my computer asked me to authenticate myself with my fingerprint or with Face ID.
00:01:52.210 --> 00:01:56.831
It will not actually save this biometric data, but still it's a second layer of protection.
00:01:56.831 --> 00:02:03.046
So I need to authenticate myself and then it will send a public key to the server and the server will save this public key.
00:02:03.046 --> 00:02:05.728
And now I'm registered already, right?
00:02:05.728 --> 00:02:07.745
So the server has the public key.
00:02:07.885 --> 00:02:22.469
I have a private key and, technically like, the server sends a challenge to my device that I need to sign with my private key, and then it sends back that signature or whatever it's called, and then authenticates with the server.
00:02:22.469 --> 00:02:28.473
So this has a huge advantage that there's actually no password saved on the server, right?
00:02:28.473 --> 00:02:34.212
It's more like SSH keys, where you also do have a private key and a public key.
00:02:34.212 --> 00:02:36.007
Do you need this biometric data?
00:02:36.007 --> 00:02:42.556
There are multiple options when you are asking people to register or authenticate from a server side.
00:02:42.556 --> 00:02:46.050
You can also say I don't require it or it's like my preferred method.
00:02:46.050 --> 00:02:57.447
So there are different levels of security that you can ask for as a password provider, but typically the most convenient type of pass keys and still very secure one is where you can create multiple pass keys.
00:02:57.447 --> 00:03:04.229
They will be saved to your key chain of your device and then the password manager will even sync this private key.
00:03:04.229 --> 00:03:09.352
So once you have this pass key on your desktop, you can also log in with your mobile device.
00:03:09.700 --> 00:03:14.271
So it basically means like, if you have all Apple devices, you're pretty good to go right.
00:03:14.271 --> 00:03:21.229
If you have an Apple desktop and like an Android phone, I am sure that it will be a little more complicated right.
00:03:21.419 --> 00:03:23.989
I heard that this is what they want to work on.
00:03:23.989 --> 00:03:37.750
For example, if you try to create a pass key on your Safari browser on the Mac, it even asks you there if you would like to use your Android device to register, because right now you can use it across multiple devices already.
00:03:37.750 --> 00:03:38.651
Let me show that.
00:03:38.651 --> 00:03:48.028
Let me like create a new pass key, but this time I want to use a phone or tablet, and then it will show me here a QR code.
00:03:48.028 --> 00:03:59.247
I can then scan that with my phone and then I can create a pass key on my phone right In an Apple native way, or did you need to install an app for that?
00:03:59.560 --> 00:04:00.825
No, that's absolutely native.
00:04:00.825 --> 00:04:02.039
That's a native password manager.
00:04:02.039 --> 00:04:05.486
I didn't have to do anything and now I have this pass key on my device.
00:04:05.486 --> 00:04:09.950
And now let me sign out and let's have a look at the login experience and say sign in.
00:04:09.950 --> 00:04:22.408
And now I can either directly sign in with the pass key from my computer and all I have to do is like click, continue, authenticate and I'm in, like I don't even need to enter a username.
00:04:22.408 --> 00:04:26.310
This is just like one click sign me in and it's like confirm and you signed in.
00:04:26.720 --> 00:04:30.271
Now let's log out again and sign in with my phone.
00:04:30.271 --> 00:04:37.966
So let's assume this was on a computer of my friends and I can still say sign in, use different device, use phone or tablet.
00:04:37.966 --> 00:04:50.668
And then I will again scan this QR code and then on my device it will ask me if I want to sign in with this passkey that is saved on my phone, actually, and then it will authenticate on the desktop computer.
00:04:50.668 --> 00:04:54.069
But once I'm logging out of that computer there's no relationship.
00:04:54.069 --> 00:04:56.401
No password ever was saved on this computer.
00:04:56.401 --> 00:04:56.822
Wow.
00:04:56.862 --> 00:04:58.545
Yeah, that's super nice Questions.
00:04:58.545 --> 00:04:59.908
Yeah, yes, go ahead.
00:04:59.908 --> 00:05:04.045
What about sharing passkeys with other people?
00:05:04.346 --> 00:05:05.048
It's possible.
00:05:05.048 --> 00:05:13.769
For example, on iOS you can share your passkeys through the password manager, but you can also use AirDrop to share your passkey with someone else.
00:05:13.769 --> 00:05:17.350
You cannot send it via email because that will be insecure, kind of.
00:05:17.350 --> 00:05:19.947
It's really more like almost like a physical key.
00:05:19.947 --> 00:05:25.545
You create keys, you can create duplicates of keys and so on, so it's just the key.
00:05:25.545 --> 00:05:30.283
It's just like a much more secure type of key than a password For personal use.
00:05:30.302 --> 00:05:31.346
this is awesome.
00:05:31.346 --> 00:05:32.865
What about in a business context?
00:05:32.865 --> 00:05:35.165
We use a password manager in our company.
00:05:35.165 --> 00:05:36.427
Right, it's one password.
00:05:36.427 --> 00:05:37.831
Do they support passkeys?
00:05:37.831 --> 00:05:42.389
Yes, Can you use them, store them in one password and put them in a vault where multiple people have access to?
00:05:42.649 --> 00:05:47.288
Absolutely, you can create them, store them there and when you go to the website, one password will pop up.
00:05:47.288 --> 00:05:49.406
Hey, these are your four accounts for this website.
00:05:49.406 --> 00:05:50.504
Which one do you want to use?
00:05:50.504 --> 00:06:00.264
You tap it and then you're signed in and one password is currently working on a solution to actually log into one password with the passkey.
00:06:00.500 --> 00:06:03.649
That would be super nice, because I always hate the master password right.
00:06:03.649 --> 00:06:07.269
It seems like I need to also switch to passkeys.
00:06:07.428 --> 00:06:09.081
Absolutely and like seriously.
00:06:09.081 --> 00:06:15.329
This is going to be the future of passwords and actually there are quite a few providers who support this already.
00:06:15.329 --> 00:06:16.502
There is this website, passkeys.
00:06:16.502 --> 00:06:18.108
directory, I think.
00:06:18.108 --> 00:06:23.012
It's provided by one password and shows you all the providers that support passkeys already.
00:06:23.220 --> 00:06:31.350
Now I'm really interested in how to get this to work with WordPress and also how we can say all the websites that Bleach develops are accessible with passkey.
00:06:31.350 --> 00:06:33.485
I guess we can talk about this in the next episode.
00:06:33.726 --> 00:06:36.880
Absolutely Thanks.