Apple’s upcoming iOS 15 and macOS Monterey preview a new feature called “Passkeys in iCloud Keychain,” an attempt to help change passwords with a more secure login process. Instead of logging into an app or website using a text string, the WWDC presentation shows how you can instead use Face ID, Touch ID, or a security key to gain access. Passwords are then synced between your Apple devices using iCloud.
Although passwords are the most popular way to secure your account But there are many problems. Passwords can be phishing, forgettable, and insecure if used incorrectly. (Think about how many times you̵7;ve been tempted to reuse passwords across multiple accounts.) But Apple thinks the new Passkeys solution can fix these problems, as shown in the comparison chart below.
In a demo, Apple showed how this new feature can reduce the need to create a password to sign in to an app or website in the first place. Instead of creating a username and password during the usual registration process, Apple’s Authentication Experience Engineer Garrett Davidson simply enters a username and allows the app to register his Face ID as a password. He then showed how he could use Face ID to sign into future apps. or even logging into his account through the service’s website, it works on Macs with Touch ID as well.
The functionality is compliant with WebAuthn standards, with Apple, Google, Microsoft, and others slowly adding support. Over time, last year Apple added support to offer password-less logins in Safari in iOS and macOS, but the new approach goes even deeper by integrating WebAuthn into the app’s sign-up process. P and sync your credentials on Apple devices via iCloud.
Behind the scenes, WebAuthn uses public key encryption to let you log in without actually having your private credentials leave your device. But your phone or computer only sends you a “signature” which proves your identity without sharing your secret private key.
Apple admits that the feature is in its infancy. This year’s preview only. And it’s off by default in iOS 15 and macOS Monterey. Developers can enable it. But it is not intended for widespread use. There’s also a clear limitation that this feature uses iCloud to work, so you’re out of luck if you need to sign in to the same service on your Windows or Android device. Apple admits this is a problem. But it is working to improve cross-platform support in the future. Apps and websites must also enable support for the new process.
But this move is another sign of the growing momentum behind password ditching. Microsoft has announced plans to make Windows 10 password-free, and Google has been working to make it possible to sign in to its services. without a password