The FIDO Alliance, an alliance working on new authentication methods to replace traditional passwords, announced last month that Apple, Google and Microsoft have committed to expanding support for the FIDO standard across their platforms. As part of WWDC 2022, Apple revealed that iOS 16, iPadOS 16, and macOS 13 finally allow passwordless logins with “passkeys.”
In fact, iOS 15 and macOS 12 are already compatible with the FIDO standard. However, with the previous implementation, the user had to log into each app or website on each device before enabling the passwordless login method. With the latest Apple software, passwordless login has become a reality. Like Apple during WWDC 2022 keynote explainediOS 16 and macOS 13 now have “passkeys,” as this authentication method is called. With passkeys, users no longer need to enter a username and password to log into apps and websites, which reduces the risk of phishing attacks.
How passkeys work in iOS
For users, signing in with a passkey works just like signing in with iCloud Keychain and Face ID or Touch ID. Simply select the access token, authenticate the biometric data and that’s it. While iCloud Keychain automatically fills in the username and password in plain text fields, the passkey goes well beyond that. The system generates a unique key that can only be accessed with user authentication via Face ID or Touch ID. This prevents malicious websites from trying to steal your passwords, as passkeys are stored securely in iCloud Keychain and are not visible to the user.
Devices can generate QR code
Of course, passwords are automatically synced with your Apple devices. But what about other platforms? Since passkeys are based on the FIDO standard, which also applies to Android and Windows, there is a way to sign in on a device that isn’t yours. The other device generates a QR code that can be read by your iPhone or iPad. iOS uses Face ID or Touch ID to confirm that you’re trying to sign in before accepting or rejecting an app or website request on the other device. And if you don’t own an iOS device or Mac, passkeys can be shared via AirDrop.
Availability and implementation
Since it’s a new API, developers need to update their apps and websites to support the new standard, so it may take some time for this technology to spread. Apple has already provided extensive documentation to help developers implement passkeys in their iOS and macOS apps. iOS 16 and macOS 13 is currently available as a developer beta program through the Apple Developer website. A public beta will be offered next month, while the official version will be released to all users in the fall. Here you can see if your device is compatible with the new software. (Photo: Apple)
