Why You Should Ditch Passwords for Phishing-Resistant Passkeys

Thanks to the rise of AI, it’s now more crucial than ever to stop relying on passwords to protect your accounts. Google and Microsoft are leading the charge in urging users to switch to passkeys, a safer alternative to traditional passwords. So, what exactly is a passkey? It’s a digital credential that lets you log in to apps and websites without the need for a username or password. Instead, it uses the same unlock methods that you use on your device. For instance, with a passkey, you can log in using:

• Biometrics: This includes methods like fingerprint or facial recognition (Face ID, Touch ID, Android Fingerprint/Face Unlock, and Windows Hello).
• PIN/Pattern: Similar to unlocking your phone with a PIN or pattern.

Since passkeys don’t rely on passwords, there’s no chance for attackers to steal your login credentials. This makes them resistant to phishing attacks. In fact, unlike traditional two-factor authentication (2FA), there are no codes to steal. As one expert puts it, this makes passkeys “phishing resistant.”

But while we move toward safer login methods, cybercriminals are also upping their game. Okta, a leading identity and access management company, reports that cyber attackers are using advanced AI tools to create highly convincing phishing sites. One such tool, Vercel’s v0.dev, allows hackers to create phishing pages just by typing simple text prompts. Okta has seen this AI-powered platform used to replicate the login pages of major companies, including Microsoft 365 and various cryptocurrency firms.

This shift in tactics means the old ways of spotting phishing attacks-like noticing spelling mistakes or odd website URLs-are no longer effective. In fact, even two-factor authentication (2FA) can’t fully protect you from these sophisticated attacks. The best way to safeguard your accounts? Use passkeys wherever possible and avoid relying on passwords. If you do need to use a password, make sure it’s long, unique, and supported by a robust, non-SMS-based 2FA.