Safeguards
Passkeys
What are passkeys?
A passkey is a sign in method without a password. Instead of a secret you type, your device proves to the website with a cryptographic key that it is you. It is unlocked with a fingerprint, a face or the device PIN.
The key advantage concerns phishing. A passkey is tied to the address of the genuine website. If you land on a rebuilt sign in page, the passkey simply does not work there. A password, by contrast, you would type into the fake page as well, and a one time code by SMS can be asked for in real time.
The secret part of the key never leaves your device. The website stores only the public part. If that website is later breached, the captured data grants no access, because nothing can be signed with it.
In practice the question is recovery. What happens when a device is lost? Passkeys can be carried to several devices through an Apple, Google or Microsoft account, or through a password manager. Decide in advance which route your business takes and how an employee regains access.
All terms in the knowledge base
Legal notice: We are engineers, not lawyers: we cannot and will not make any statements on legal questions. This entry is purely technical, reflects the state of knowledge to the best of our understanding, and is not legal advice; it does not replace review by a qualified lawyer. No guarantee is given as to correctness or completeness; liability arising from the use of this information is excluded to the extent permitted by law. What counts is always the version currently in force at the responsible body, for example dsb.gv.at, nis.gv.at or enisa.europa.eu. AI transparency: parts of this entry may have been created with AI assistance, so errors are possible despite review: please report errors here · how we create content.
From the term to practice
Where does your business actually stand?
The IT Check reviews your IT across 8 audit areas with more than 100 individual checks and delivers documented findings with a prioritised action plan. From 1,299 € excl. VAT.
office [at] vetosec [dot] at · vetosec.at/contact/
