Passkeys are a safer alternative to passwords where users can authenticate using biometrics, a PIN, or pattern, and have been adopted by a number of other technology companies, like Amazon, GitHub, Google, PayPal, and more. 

With the new API support for third-party passkey providers, users will be able to utilize their preferred external passkey app. To implement this, Microsoft has been partnering with providers like 1Password, Bitwarden, and others.

“At Microsoft, we truly believe that security is a team sport. By partnering with OEMs, app developers and other partners in the ecosystem, and by helping people be better at protecting themselves—we are continuing to make Windows more secure by design and more secure by default,” Katharine Holdsworth, partner group product manager for Windows Security at Microsoft, wrote in a blog post. 

The experience for creating and using passkeys has also been improved. When a user visits a website that supports passkeys, they will be prompted about how they want to save those passkeys, with one of the options being to save to their Microsoft account. Users saving to their Microsoft account will need to go through a one-time setup where they will create a recovery key that will later be used to verify their identity and protect their passkeys. Once this initial setup is complete, they will be able to sign in to the website and save their passkey through Windows Hello. 

Passkeys saved through Windows Hello can be synced to multiple Windows 11 devices, providing users a more seamless sign-on process across all of their computers. 

“Microsoft is committed to making passkeys more readily available wherever you need them, with the experience, flexibility and durability that you expect when using Windows,” Holdsworth wrote. 

According to Microsoft, these three new features will start rolling out to the Windows Insider channels over the next several months. The company will also be sharing more information during sessions at Authenticate 2024 from October 14 to 16. 

The post Microsoft makes improvements to the passkey experience on Windows 11 appeared first on SD Times.

The ability to authenticate customers online seamlessly and securely is now a business imperative, not just a technical concern. According to Accenture’s 2023 Tech Vision survey, 85% of global executives view digital Identity as critical, with three in four noting that authentication issues have negatively impacted their bottom line due to abandoned transactions, customer frustration, and fraud. While passwords remain the most common authentication method, passkeys offer a more convenient and secure alternative. Based on FIDO Alliance and W3C open standards, passkeys provide faster, easier, and more secure sign-ins to apps and websites, across a user’s devices.

“In the age of AI where we are seeing threats escalate, passwords and legacy forms of 2FA are as inconvenient as they are defenseless. By switching to phishing-resistant passkeys, organizations can protect both their customers and their bottom line,” said Andrew Shikiar, executive director and CMO of FIDO Alliance. “Identity platforms like Okta will play a major role in driving widespread adoption as they provide a streamlined solution that developers and product teams can leverage to quickly upgrade consumers’ security and user experience; we applaud Okta’s support for passkeys in its Customer Identity Cloud and encourage its customers to take advantage of this important capability.”

Supported by major tech platforms, passkeys are both phishing-resistant and easy to use. But adoption relies on making it easy for developers and digital teams to integrate passkeys into their consumer apps and websites. By supporting passkeys with a simple, no-code configuration in Customer Identity Cloud, Okta empowers any organization to embrace a passwordless future today.

“For the broader end-user population to fully embrace passkeys, they must truly become a ubiquitous feature. Achieving this ubiquity hinges on ensuring that it’s seamless for all developers to incorporate passkeys into their applications,” said Vittorio Bertocci, Principal Architect at Okta. “We’re doing our part to achieve widespread adoption by making it easy for developers to add sophisticated passkey support whether they’re updating an existing app, or building something new.”

No Trade-Offs Between Security, Privacy, and User Experience

Okta today announced several enhancements to its CIAM offering, Customer Identity Cloud. SlashData’s Developer Nation Q1 2023 survey revealed that Auth0 by Okta, the technology that powers Customer Identity Cloud, is the most used authentication provider among developers.

“Passkeys are powerful, but they’re also just the tip of the spear. Okta Customer Identity Cloud supports a variety of use cases across consumer and SaaS applications, wherever organizations need both better security and user experience,” said Shiven Ramji, President of Customer Identity Cloud at Okta. “Paired with our powerful extensibility, Okta gives application builders the most complete set of authentication, authorization, lifecycle and user management, and Identity security tools, so they can focus more on innovation, and less on Identity.”

New CIAM capabilities include:

• Support for passkeys simplifies implementation of passkeys to reduce login friction, while protecting organizations from credential-based threats. Okta’s support for passkeys covers critical user flows such as sign-up, sign-in, and account recovery, with seamless passkey management for admins.

• Okta Workflows No-Code Automation for Customer Identity enables developers and digital teams to improve security posture, and drive stronger customer experience and retention by personalizing Customer Identity flows without writing code.

• Phone number as sole identifier makes it easier to support more users, in more countries where phone number is an expected form of authentication, such as in Asia-Pacific or Latin America. An available passwordless option allows users to sign-up with just their phone number.

• Password recovery enhancements allow developers to enhance security and lessen support burdens by integrating multi-factor authentication (MFA) into their password reset flow, or give customers the ability to reset using any enrolled factor.

• Custom sign-up prompts enable developers to create personalized registration journeys directly within the new Universal Login. Sign-up prompts can be tailored to customer preferences, localization needs, privacy, consent, and beyond.

Availability

Support for passkeys is available today in early access, and will be generally available in Q4 2023. Okta Workflows is generally available for joint customers of Okta Workforce Identity Cloud and Okta Customer Identity Cloud. Password recovery options, and custom sign-up prompts will be available in early access later this month and generally available in early 2024. Phone number as a sole identifier will be available in early access in November and generally available in early 2024.

Any unreleased products, features, or functionality referenced in this release that are not currently available, may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and customers should not rely on them to make purchase decisions.

Check out all of Okta’s announcements at Oktane 2023.

The post Okta Launches Passkey Support to Help Enterprises Unlock a Passwordless Future appeared first on SD Times.

For users, using a passkey is similar to confirming the use of a saved password by scanning one’s fingerprint or using facial recognition. 

“We have worked with others in the industry, including Apple and Microsoft, and members within the FIDO Alliance and the W3C to drive secure authentication standards for years. We have shipped support for W3C Webauthn and FIDO standards since their inception. Today is another important milestone, but our work is not done. Google remains committed to a world where users can choose where their passwords, and now passkeys, are stored,” Diego Zavala, product manager for Android; Christiaan Brand, product manager for Account Security at Google; Ali Naddaf, software engineer of Identity Ecosystems at Google; and Ken Buchanan, software engineer for Chrome, wrote in a blog post. 

The announcement today enables two capabilities related to passkeys. First, users will now be able to create and use passkeys on Android. The passkeys are synced through Google’s Password Manager. 

Second, developers can incorporate passkey support into their applications using the WebAuthn API for Chrome applications. Google’s next major milestone towards supporting passkeys will be to offer an API for native Android apps. 

According to Google, the passkeys that are created through that API will work with apps that are affiliated with the same domain. Google believes that the API will also provide a unified way to let users choose if they want to use a passkey or password. 

“Seamless, familiar UX for both passwords and passkeys helps users and developers gradually transition to passkeys,” the team wrote. 

The post Google announces support for passkeys on Android and Chrome appeared first on SD Times.