Microsoft has unveiled its latest security advancement, allowing non-commercial users to sign into their Microsoft accounts and applications using passkeys. This update, which supports facial recognition, fingerprint scanning, and device PINs as authentication methods, is now available across Windows, Google, and Apple platforms. Microsoft describes this initiative as a significant stride towards realizing its decade-long vision of creating a world devoid of passwords. Starting from the announcement, users can access their Microsoft accounts through desktop and mobile browsers using passkeys, with promises of mobile app support on the horizon.
The Rise of Passkey Authentication
The technology behind passkeys is rooted in a FIDO alliance standard, which has garnered support from tech giants such as Apple, Microsoft, and Google. The mechanism is straightforward yet secure: upon creating an account on any website or application, the user's device generates a cryptographic key pair. The public key is shared with the application's backend, while the private key remains securely stored on the user's device. Authentication is achieved through a digital handshake that verifies the user's identity without revealing the private key. This method is inherently more secure than traditional passwords, as it requires physical possession of the user's device and access to the user's unique biometric data or PIN to unlock the private key.
A Future Without Passwords
Microsoft's move to expand passkey support comes at a critical time, as the company reported a staggering 3,378 percent increase in password attacks since 2015, with current figures showing more than 4,000 attacks per second. The vulnerability of passwords, regardless of their complexity, underscores the urgent need for more secure authentication methods. Passkeys not only enhance security by being unique to each website or app, thereby resisting phishing attempts, but also simplify the user experience by eliminating the need to remember and manage multiple passwords.
In their announcement, Microsoft officials highlighted the simplicity and security offered by passkeys, emphasizing that users would no longer need to worry about creating, forgetting, or resetting passwords. While acknowledging that no security measure is impervious to attacks, Microsoft expressed optimism that passkeys represent a significant advancement in online security.
