GitHub passkeys are now available in public beta

In digital security, the weakest link is often the humble password. It's a well-known fact that over 80% of data breaches are rooted in compromised passwords. GitHub, widely used by developers around the world, is taking an important step towards improving account security by introducing passkeys in a public beta phase. This move is part of GitHub's ongoing efforts to ensure robust account security without compromising user experience.

The introduction of access keys by GitHub is an important step towards a safer, passwordless future. It offers users a more flexible, reliable and secure way to authenticate their accounts. As we move forward, it will be interesting to see how this technology evolves and how it will shape the future of digital security.

Understanding Access Keys

Security keys are an evolution of traditional security keys, offering easier setup and improved retrievability. They provide a secure, privacy-friendly, and user-friendly method to protect your accounts while reducing the risk of account lockout. Unlike other methods such as SMS and email, access keys are unique to each website, eliminating the possibility of user tracking across multiple sites. The introduction of access keys brings us closer to a passwordless future, aiming to eliminate password-based breaches.

Configuring passkeys on GitHub

To start using access keys with your GitHub account, you need to follow a few simple steps. First, navigate to the "Settings" sidebar of your GitHub account. From there, locate the "Features Overview" tab and click on "Enable Passkeys". After you enable security keys, you can upgrade eligible security keys to security keys and register new ones. This process is simple and designed to be user-friendly.

User Verification

Passkeys on GitHub require user verification, which basically means they count as two factors in one. They combine something you are or know (like your fingerprint, face, or PIN) and something you own (like your physical security key or device). This two-factor authentication eliminates the need for a password, ensuring a secure login process. With extensive browser support, your browser's autofill system can automatically suggest using your password to log in, right from the login page. This feature is not limited to users with 2FA enabled; all users can log in using only their password.

Cross-device authentication with Passkeys

Passkeys are not limited to the device they were created on; they can be used on all your devices. A feature known as cross-device authentication lets you use a password on your phone or tablet to log in to your desktop by verifying your phone's presence. This can be done by selecting a previously paired device or by scanning a QR code with your phone. This feature continues FIDO's phishing resistance promise.

Many passwords can be synced across your devices, ensuring you'll never be locked out of your account due to key loss. Depending on your passkey provider, your passkey may be automatically synced across your devices. For example, your iCloud account will sync passkeys from iOS to macOS, Google Password Manager syncs across your Android devices, and password managers like 1Password or Dashlane can sync passkeys between installations of their password managers on any device. However, not all passwords are synced across devices. In your user settings, GitHub shows a "synced" label on credentials marked as syncing.

Upgrading Security Keys

If your security key is capable of verifying your identity (e.g. Touch ID, Windows Hello, Android fingerprint, or PIN-locked or biometric hardware keys), it can be upgraded to a security key. 'authentication. The next time you log in with this security key, GitHub will ask you if you want to upgrade it to a security key. This re-registration ensures that your access key is discoverable upon authentication and synchronized if supported.

For more information on the new introduction of GitHub Passkeys now available in public beta, visit t...