About Passkeys and Security Keys
First, it is important to know that passkeys are used at Wake Forest University as a 2nd factor (2-step verification) for our WFU Google Accounts. Yet unlike more traditional options like SMS, phone calls, or numeric codes, passkeys and security keys cannot be used by a hacker from far away. They work only in close proximity to you (the real account owner) and your login.
Passkeys
What they are:
- Passkeys are accessed through your protected, trusted devices, and they cannot be shared with others. Because they can be used with your face or fingerprint (if you unlock your device with these methods), they are very convenient.
- Passkeys are stored in a secure cloud service, like Apple's iCloud Keychain or Google Password Manager. This allows them to be used across all your devices that are connected to that service.
Convenience:
- You can use the same passkey on any of your devices (iPhone, iPad, Macbook, for instance).
- If one passkey device is lost or left behind, others can then be used as backup.
Security:
- Even when passkeys are synced using a cloud service like iCloud, the private key portion remains primarily within the Secure Enclave of your devices. This means it's heavily protected from software-based attacks.
Example:
- When prompted, tap your finger to engage your TouchID and unlock your passkey for accessing your WFU account.
Security Keys
What they are: A small, physical key fob that looks like a flash drive.
Convenience:
- Can be kept on a keychain, stored in a drawer or in your laptop bag.
- Can also be used to generate a one-time code to access a service that may not accept passkeys.
Security: A security key is an entirely unique, physical device that only works in close proximity to the device trying to log in. This makes security keys extremely resistant to phishing.
Example:
- Plug in your security key and when prompted, tap it to unlock access to your account.
Key Differences Summarized:
- Location: Security keys are on a single device; passkeys are in the cloud.
- Convenience: Passkeys are more convenient.
- Security: Both are the most phishing-resistant 2-step options. Passkeys are very secure but with a slightly higher theoretical risk.
Which is Better?
- It depends on your priorities.
- Many people will likely use a mix of both. For example, using device bound passkeys for very sensitive accounts like banking, and synched passkeys for more general use.
- IS recommends setting up multiple passkeys, including synched (Google Password Manager, iCloud, Windows Hello), as well as device-bound (security key such as Yubikeys).
Ready to set up passkeys?
Visit go.wfu.edu/passkeys to learn more or visit your Google account to add passkeys.
Passkeys Frequently Asked Questions
I'm not sure I want to use my biometric data to confirm my identity. How will it be kept safe?
Only a mathematical representation of your biometric data is stored, and only in a very secure part of your device. See these articles to learn more:
- Refer to the Apple support article: About Face ID advanced technology
- Review the iCloud Keychain security overview
- Read the Windows Hello frequently asked questions (FAQ)
I still do not want to use biometric data to create a Passkey. What are my options?
On a Windows device, you may use the Windows Hello PIN option instead of using a fingerprint or facial recognition.
If you have a Mac computer and would prefer to gain the security benefits of a passkey without using your fingerprint, follow these steps: copy link
Open this link in Google Chrome (recommended for the best experience with Google Workspace).https://myaccount.google.com/signinoptions/passkeys
Sign in to your WFU Google account.
On the Passkeys and security keys page, click Create a passkey.
Click Create a passkey(again).
When prompted to turn on iCloud Keychain, click Cancel.
When asked where to save your passkey for google.com , choose Your Chrome profile.
Click Continue.
Click Use Password...
On the Passkey created page, click Done.
How often will I be asked to use a passkey to authenticate on my device?
Not often. It is similar to the frequency you are asked for an SMS code, Authenticator App code, etc.
I have a Mac. It is asking to save my passkey in the iCloud keychain. What does this mean? Is it safe?
It is very safe. See this article from Apple to learn more: Make your passkeys and passwords available on all your devices with iPad and iCloud Keychain.
How do I know if I have created a passkey for my WFU Google account?
Go to the Google Account Passkeys management page. If you have created any passkeys, they will be listed at the bottom of the page.
Under my list of passkeys, I see a device with the note “Created Automatically by Android”. What is it, can I use it, etc.?
Our experience is that these are not usable passkeys. If that message is on a device you would like to use with a passkey, please follow the instructions above to set one up.
I set up passkeys for my account, but Google is still prompting me to input a code I received from a less secure method (SMS, Authenticator, etc.). How do I tell it to ask for a passkey first?
When you are asked for a second factor, either choose “Try another way” and/or “Use your passkey”. After you use it one time, Google should default to it the next time.
What do I do if I have problems using my passkey?
If you have problems using your Passkey, you may select the option for try another way to use a secondary 2-step verification option. Please see the following article for more information. If the problem persists, please reach out to the Service Desk for further support.
Passkeys at Wake Forest: Check our Progress
Thanks for joining us in the resistance against phishing! We applaud you for helping us make a difference at Wake Forest, together. Share with your network to spread the word using the link to Passkeys at Wake Forest University.
Was this answer helpful? Yes No