Functionally, for you, no difference. You'd still do a TouchID or FaceID. What's happening today is that entry from you is pulling your password out of the Keychain and pasting it into the fields for you. That password would instead be replaced by, if you'll allow me to illustrate this as best I can, with a one-time use token - like the old RSA tags or soft token you may have on your/work phone to sign into a VPN, or access a restricted system at work. There's additional layers of security that appear to work like PGP with a private key you control and generate public keys from, but the general gist of it is your password is replaced by a tokenized entry.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Apple Wants Passkeys to Replace Passwords: Here's Where You Can Try Them Out Now With iOS 16
- Thread starter MacRumors
- Start date
- Sort by reaction score
Functionally, for you, no difference. You'd still do a TouchID or FaceID. What's happening today is that entry from you is pulling your password out of the Keychain and pasting it into the fields for you. That password would instead be replaced by, if you'll allow me to illustrate this as best I can, with a one-time use token - like the old RSA tags or soft token you may have on your/work phone to sign into a VPN, or access a restricted system at work. There's additional layers of security that appear to work like PGP with a private key you control and generate public keys from, but the general gist of it is your password is replaced by a tokenized entry.
Thank you for the explanation. Two quick questions. 1) Will the passkey token used by widget.com enable widget to track my activity across the internet (in the same way that widget.com can track my activity with cookies). 2) what happens if my phone breaks or I loose my phone? Presumably I am locked out of all my accounts until I buy a new device?
I think you can’t. That is part of the design, no one but you can access your accounts.
Of course not.
They are simply going to receive a dodgy request by email, text, phone call or whatever. As they will feel very secure because of all the nice security technology that they have, they will not complain and will bravely serve the request. And approve it with face ID, fingerprint ID and what not.
The token is site specific, so only sites operated by the same company could track you, presumably on only the original URL's domain for which the token was generated.
You can recover the tokens from your keychain, provided you enabled syncing of your keychain to your iCloud account.
it’s all ***** and giggles until I let Tom Cruise log in for me but it’s secretly that pesky Dougray Scott trying to hack my details
I think the idea is that the device you're logging in with ALSO has your private key for the passkey. If you're logging in on your Mac, your Mac will have your passkey. If you're logging in with your iPhone, your iPhone will have your passkey. Nothing says the device you log in on has to be different than the device holding your passkey.
What are you logging in with if not your iPhone or Mac or iPad, all of which would support passkey?
Keep in mind Google and Samsung and Microsoft are also supporting this, so they'd probably have your passkey, too, if you have one of their devices/computers.
Facebook, Twitter, Instagram , that’s 3. All passwords 15 digits long
All my bank details across various accounts of which I have 5 accounts- that’s 8. Banking passwords -30 digits long
Retail passwords where I shop online like Amazon etc - easily 10-15 there , that’s 23
Each password would take the most powerful supercomputer on Earth around 400 vigintillion years to brute force entry into any account, that number is 400 followed by 63 zeros.
I believe it will because fake sites won’t be able to trick users into entering their password, because their is none and the user can only enter a passkey via biometrics on the proper domain
Ok, i have the latest Ventura and went to one of the site that, according to the article, supports Passkey - PayPal.com - where i already have a login. When i go to the login page, I'm still asked to enter my login/password. Is there something that needs to be enabled in the browser (if so, I don't see a setting) to use this new mechanism?
I can’t use personal devices where I work, so I rely on “public” devices provided there to check my personal email, login to my media subscriptions, shop on ebay, etc
Also, when I travel for pleasure I usually don’t bring any of my devices….but rather rely on the device wherever I am staying if I need to schedule a bill payment or check my e-mail/text.
That was the beauty of the internet. I am free to access my personal information/accounts/subscriptions using any device, anywhere in the world. I am not tied to a specific physical thing.
Saying I have to use this exact phone or that specific laptop or the desktop in my home office, etc to use my accounts feels like the days where I had to carry a CD, DVD or paperback book around with me if I wanted to listen to music, watch TV, or read a novel.
Last edited:
Welp, I guess this is one way for Netflix to stop password sharing.
But only a few moments to fool a non techy pawpaw into entering their new user name and 15 digit password into a spoofed site. No super computer required. Or a device with the wrong unvetted 3rd party app on it that is monitoring key strokes and transmitting you passwords.
My bank starting doing something similar (although not quite that bad, scan and touch ID, geezzzz) and I closed my account and switched banks. I wanted to support my local credit union, but their digital requirements made their online banking impossible for me to use.
Makes sense. Thanks for explaining it better than apple did in their press release!
What makes a yubikey interesting for you in the future while you already carry a phone?
This is something I'm also wondering about. Yes, it's nice to be able to just use FaceID or my fingerprint to log in to a website, but I don't want to completely lose access to everything if I lose my phone or it's stolen.