GCHQ’s National Cyber Security Centre (NCSC) has announced that passwords should be a thing of the past and that passkeys should be adopted en-masse to decrease security risks.
A new report from the NCSC found that FIDO2 credentials, including passkeys, are as secure or more secure than traditional MFA for individuals. This follows last year’s announcement that the UK government would roll out passkey technology for its digital services as an alternative to the current SMS-based verification system.
Steven Furnell, Senior IEEE Member and Professor of Cybersecurity at the University of Nottingham, said: “The NCSC’s recommendation to use passkeys ‘wherever a service supports them’ is good from both security and usability perspectives. Passkeys have been specifically designed to overcome our primary problems with passwords.
“However, the ‘wherever supported’ aspect is a potential challenge, because many users won’t be able to follow the guidance uniformly or consistently across the services they use. Many sites and services still don’t offer passkey support, so users will find themselves with a mixed login experience.
“Another likely challenge is that many users won’t know what passkeys are or why they’re now the thing to be looking for. We’ve been telling them for years to use better passwords and then to use two-step verification or MFA. And now there’s something else.
“It’s still the correct advice, but no matter how good passkeys are, we need to recognise that this is going to be a long game rather than flipping a switch.”
