What is a passkey?

What does passkey mean?

Deploy phishing-resistant MFA, such as FIDO2 security keys, device-bound passkeys or platform authenticators, particularly for privileged and high-risk users

When a passkey is created, the device makes a pair of keys. The site keeps the public one; the private one never leaves the person's device or synced account. Signing in proves possession of the private key. The proof is bound to the site's own address.

That binding is what makes a passkey resist phishing. A relay sign-in page can pass on a password and a six-digit code as they are typed. It cannot pass on a passkey's answer, because the answer is made for a different address.

Canada's Cyber Centre names device-bound passkeys among the phishing-resistant methods it recommends against the help-desk calls that lead to relay pages. Passkeys are set up inside a firm's sign-in settings, where no external reading can look; the lure names that come before such calls can be seen.

Where does it show up in a reading?

In a LeakTrace reading it is read under “Names made from yours for fake sign-in pages”: the sign-in words attackers use (sso, mfa, enroll, activate, passkey and helpdesk) joined to your firm's name.

Whether staff use passkeys is inside the firm and is not read; the reading names the lure names joined from the firm's name and a sign-in word.

Which pages use this term?

• Relay sign-in page
• Lure domain
• Breach-listed address