Passkeys

Passkeys represent a modern and simplified approach to secure user authentication. Unlike traditional passwords, which require the user to remember and enter a series of characters, passkeys use a public key cryptographic model to authenticate users. They are designed to make the login process more seamless and secure, reducing the reliance on passwords that can be forgotten, stolen, or phished.

At a high level, passkeys work by creating a pair of cryptographic keys – one stored securely on the user’s device (private key) and one stored on the Infor server (public key). When you log in, the service verifies the private key through your biometric authentication, such as a like fingerprint or facial recognition, or a PIN. Since the private key never leaves the device, passkeys provide a highly secure and phishing-resistant authentication method.

Security benefits of using passkeys over passwords

Passkeys offer several advantages over traditional password-based authentication, including:

Phishing resistance: Passkeys eliminate the need for users to enter passwords, making them immune to phishing attacks.
No credential reuse: Since passkeys are unique to each site, users cannot reuse them across different applications, reducing credential-stuffing risks.
Eliminates password-based attacks: No risk of brute force, dictionary, or credential stuffing attacks, as passkeys do not rely on shared secrets.
Seamless user experience: Users can authenticate using biometrics (fingerprint, facial recognition), PIN, or a FIDO2 security key, improving ease of access without compromising security.
Multi-device synchronization: In supported ecosystems, passkeys are securely stored and synchronized across devices, allowing seamless login experiences.