Passkeys are FIDO multi-device credentials and a replacement for passwords. Passkeys solve most of the shortcomings of passwords. These shortcomings make passwords one of the biggest cybersecurity risks and cause a great deal of frustration and annoyance for users.

Unlike passwords, passkeys are not based on secrets that you come up with, remember, and share with online services. This makes them resistant to phishing attacks and data breaches at online services.

Can we stop using passwords today and switch straight to passkeys? Unfortunately not. Support for passkeys by online services and the management of them by end users are the two main obstacles standing in the way of universal passkey adoption.

MindYourPass is introducing two innovations that accelerate the adoption of passkeys and make managing them easier.

Read below how MindYourPass uses these innovations to enable a smooth transition from passwords to passkeys.

Password management becomes passkey management

Technically speaking, a passkey is a cryptographic key pair consisting of a public key that is shared with the online service during the registration process, and a private key that stays with the user. During authentication, the private key is used to sign a so-called ‘challenge’. Naturally, the private key must remain secret. Each account on an online service uses its own key pair. This means the number of secret keys that need to be managed is comparable to the number of passwords a user has today.

Passkeys across multiple devices

Passkeys are multi-device, which means they are available on every device you use to log in to an online service. To achieve this, passkeys are either stored in the cloud or in a vault and synchronized between your devices, or stored on a hardware key (such as a YubiKey) that you connect to your devices.

Every form of passkey management in which passkeys are stored is a compromise between availability and security. For example, passkeys in a vault are vulnerable if the vault is not protected well enough, and passkeys on a hardware key are vulnerable because if you lose the key, you lose access to all of your online services. In fact, this is the same compromise that makes password management so difficult.

Calculating passkeys instead of storing them

MindYourPass introduces a calculation-based method as an alternative to storage-based passkey management. This removes the limitations that come with storing passkeys.

The calculation method for managing passkeys makes the generation of cryptographic key pairs deterministic. That is, every time the key pair for an online service is needed, the ‘seed’ from which the public and private keys are derived is the result of a calculation. This way, exactly the same key pair can be obtained at any moment by applying a formula. As a result, it is no longer necessary to store the key pair anywhere.

The formula works on the basis of 3 basic input factors: the online service, the identity of the user, and the association between the user and the service. From these input factors, a 512-bit SHA2 hash code is calculated, which forms the ‘seed’.

The formula is zero-knowledge, which ensures that no single party has all the information needed to calculate a ‘seed’. The formula is stateless, so a ‘seed’ can be calculated on any device without synchronizing data between those devices. Both properties provide optimal availability and security, and represent a significant improvement in passkey management over the traditional approach in which passkeys have to be stored.

Bridging the adoption gap with … passwords

There are millions of online services, of which only a few percent currently support passkeys. This means that, despite the clear advantages of passkeys, people will have to keep using passwords until ALL online services have migrated to passkeys. During this transition period, accounts remain vulnerable and it remains difficult to use multiple technologies – passwords and passkeys – side by side.

Can’t we switch more easily and, preferably, faster?

Before an online service can support passkeys, it will have to implement the corresponding FIDO protocols and offer a process for existing accounts to switch to passkeys. This is a considerable task that is expected to take many, many years. Naturally, the more people use passkeys, the more online sites will be willing to invest in this migration.

Before a user can benefit from passkeys, they need an authenticator that supports passkeys and will have to switch to passkey authentication on online services that support it. The more online services support passkeys, the more people are willing to take this step. This ‘chicken-and-egg’ situation makes a quick transition difficult. Overcoming it will help us migrate to a safer online society much faster.

With this in mind, we propose MindYourPass as an intermediary between users who want to move away from passwords and start using a passkey authenticator for all their online accounts, and online services that still use passwords.

To this end, MindYourPass has implemented the FIDO protocol and uses it as an alternative input factor in its formula. Instead of using the formula to calculate a ‘seed’, as we discussed in the previous section, the formula is used to calculate a user’s password. This way, a passkey authenticator can be used not only for passkey-based authentication, but also to calculate a strong password for online services that still work with passwords.

In this way, MindYourPass offers a consistent user experience for online services that use passwords as well as services that already use passkeys. This lets a user log in everywhere without having to use passwords themselves, while online services have more time to implement the FIDO protocols on their own.

MindYourPass is free for personal use with no restrictions on functionality and is available on all major platforms, browsers, and mobile devices. MindYourPass is privacy by design. We value our users’ privacy so highly that we don’t even store their email address when they sign up for our services!

Want to experience for yourself how MindYourPass supports the management of both your current passwords and your passkeys? Download the free personal version from our website.