Ditch that Password! Why Your Business Needs to Embrace Passkeys
Introduction
Passwords are the weakest link in your business's security chain. They're a hassle to remember, a nightmare to manage, and a prime target for cybercriminals. But what if there was a better way? A way to secure your business that's not only stronger but also simpler and more user-friendly? Enter passkeys, the next-generation authentication technology that's poised to make passwords a thing of the past.
In this article, we'll explore why your business needs to move away from passwords and embrace passkeys. We'll cover what passkeys are, how they work, and the significant security and usability benefits they offer. We'll also provide practical, step-by-step guides to help you enable passkeys in two of the most common small business platforms: Google Workspace and Microsoft 365. It's time to say goodbye to password-related headaches and hello to a more secure and streamlined future for your business.
What Are Passkeys and How Do They Work?
At its core, a passkey is a digital credential that replaces your traditional password. It's a more secure and convenient way to log in to your accounts, using your phone, computer, or other supported device to verify your identity. Instead of typing in a password, you use your device's built-in authentication method, such as a fingerprint, facial scan, or PIN.
So, how does this magic work? Passkeys are based on a technology called public-key cryptography. When you create a passkey for a website or application, your device generates a unique pair of cryptographic keys: a public key and a private key.
The public key is stored on the website or application server. It's not a secret and can be seen by anyone.
The private key is stored securely on your device and never leaves it. This is the key that proves your identity.
When you want to log in, the website sends a challenge to your device. Your device uses the private key to "sign" the challenge and send it back. The website then uses your public key to verify the signature. If it matches, you're in! The beauty of this system is that your private key, the key that actually verifies your identity, never has to be transmitted over the internet. This makes it incredibly resistant to phishing attacks and data breaches.
This entire process is governed by the FIDO (Fast Identity Online) Alliance, a consortium of tech giants like Google, Apple, and Microsoft, who are all working together to create a passwordless future. This collaboration ensures that passkeys are a standardized and interoperable technology that will work seamlessly across different devices and platforms.
Security and Usability Benefits
The move to passkeys isn't just about getting rid of annoying passwords; it's about fundamentally upgrading your business's security posture while simultaneously improving the user experience for your employees. Here are some of the key benefits:
Passkeys are inherently resistant to phishing attacks. Because the private key never leaves the user's device, there's no secret for a phisher to steal. Even if an employee is tricked into visiting a fake website, the passkey won't work because it's tied to the legitimate website's domain.
Passkeys are based on strong cryptographic principles, making them significantly more secure than even the most complex passwords. They eliminate the risks associated with password reuse, weak passwords, and credential stuffing attacks.
No more forgotten passwords, no more frustrating password reset processes. With passkeys, your employees can log in to their accounts with a simple touch or glance. This not only improves productivity but also reduces the burden on your IT support team.
Thanks to the efforts of the FIDO Alliance, passkeys can be synced across devices. This means an employee can create a passkey on their work computer and then use it to log in on their phone, creating a seamless and consistent user experience.
By eliminating passwords, you can significantly reduce the number of password-related support tickets your IT team has to handle. This frees up their time to focus on more strategic initiatives.
How to Enable Passkeys
Most common applications used by small (and big) organizations already support passkeys. Below you will find a step-by-step guide to get your organization started right away.
Google Workspace
For businesses that run on Google Workspace, enabling passkeys is a straightforward process that can be done from the Google Admin console. Here’s how to do it:
Sign in to the Google Admin console. You’ll need to be a super administrator or have the appropriate security administrator privileges.
Navigate to Security > Authentication > Passwordless. This is where you’ll find the settings for enabling passkeys.
Enable the Skip passwords setting.
Check the box to “Allow users to skip their password and authenticate with a passkey.”
Optional) Apply to specific organizational units — If you want to roll out passkeys to a particular department or team first, select the corresponding organizational unit.
Save your changes. Once you’ve enabled the setting, your users will be able to create and use passkeys to log in to their Google Workspace accounts.
It’s important to note that once you enable this setting, your users will be prompted to create a passkey the next time they log in. You should communicate this change to your employees and provide them with instructions on how to generate a passkey. Google offers a straightforward, user-friendly process for this, allowing users to typically create a passkey in just a few clicks.
Microsoft 365
For businesses that use Microsoft 365, passkeys are managed through Microsoft Entra ID (formerly Azure Active Directory). Here’s how to enable them:
Sign in to the Microsoft Entra admin center. You’ll need to be an Authentication Policy Administrator.
Navigate to Entra ID > Authentication methods > Policies. This is where you’ll find the settings for various authentication methods.
Enable the “Passkey (FIDO2)” method. Set the toggle to “Enable” and choose whether to apply it to all users or specific groups.
Configure the settings. You’ll have the option to allow self-service setup, enforce attestation (to ensure that only genuine FIDO2 devices are used), and enforce key restrictions (to allow only specific types of security keys).
Save your changes. Once you’ve saved your changes, your users will be able to register and use passkeys to log in to their Microsoft 365 accounts.
Similar to Google Workspace, it’s important to communicate this change to your employees and provide them with instructions on how to register a passkey. Microsoft provides a user-friendly process for this, and users can typically register a passkey in just a few steps.
The Future is Passwordless
The transition to a passwordless future is not a matter of if, but when. Passkeys represent a significant leap forward in authentication technology, offering a solution that is both more secure and more user-friendly than traditional passwords. By embracing passkeys now, you can not only improve your business’s security posture but also create a more seamless and productive experience for your employees.
The time to ditch the password is now. Start your journey to a passwordless future today.
