Photoraidz/Getty Images
Previously on our passkey journey, I talked about the challenge of figuring out if a relying party -- typically, the operator of a website or app -- even offers the ability to sign in with a passkey instead of the more traditional and less secure username and password-based approach.
Some of the biggest relying parties in the world -- including Apple, Google, and Microsoft -- support passkeys as a means of passwordless authentication. Together, these tech giants can introduce billions of global users to the phishing and smishing-resistant technology. However, the vast majority of websites and apps have yet to follow suit. When will passkeys catch on enough that most relying parties support them and, more importantly, most users embrace them -- instead of usernames and passwords -- as their primary means of authentication? I estimate it will take another five to 10 years.
For users who want to get an idea of what it's like to work with passkeys today, one relying party that offers a basic passkey experience that you can try out is Shopfiy.com. If you have goods or services to sell, Shopify is an e-commerce service provider that makes it quick and easy to set up an online storefront and start booking sales. But you don't need to set up an online store in order to experiment with Shopify's passkey support, and so I used Shopify's website as an example of the path you might take to start a passkey enrollment process.
Although the path is a typical one, there'll be differences in the passkey user experience from one relying party to the next. Those inconsistencies -- minor though they may be -- are likely to confuse users accustomed to the nearly universal workflow for username and password-based authentication.
In the previous installment[, we found our way to Shopify's "Create a Passkey" button (shown below), and I described what happened next as a bit of a technological ordeal.
Shopify's option to create a passkey can be found under the Security menu in Shopify's account settings. Screenshot by David Berlind/ZDNET
Up until now, the process has been relatively straightforward -- just navigating some menus to find our way to Shopify.com's security settings. But, regardless of the relying party, that ordeal starts once you click the "Create a passkey" button (or equivalent) to start the passkey enrollment ceremony. Whether or not you successfully enroll a passkey depends on a variety of factors, including your browser, your operating system, and your choice of authenticator.
(Of the six parts in this ZDNET series, I'm dividing my coverage of the passkey registration ceremony into two parts: This part is about choosing an authenticator -- required for all passkeys. The next part describes what happens behind the scenes once you've chosen an authenticator.)
Authenticator vs password manager
... continue reading