Apple is developing a new passkey feature that will allow customers to use account authentication based on Face ID and Touch ID instead of a password, Apple engineer Garrett Davidson explained in a WWDC developer session (via CNET). .
Passkey on iCloud Keychain, a feature in iOS 15 and macOS Monterey, stores a new WebAuthn credential called a passkey on the iCloud keychain. It is used in place of a password for account creation and login, with one-touch login.
When you create an account using a passkey, there is no password to manage. You can log into that account with just one login and authentication via Touch ID or Face ID.
No password is required because the Apple device manages the generation and storage of the unique passkey used for the site, so logging in is just a matter of entering a username and authenticating.
Passwords are end-to-end encrypted and synced across all your Apple devices thanks to iCloud Keychain. Since everything is stored in iCloud Keychain, credentials are retained even if Apple devices are lost or stolen.
Passwords are more secure than most passwords as well as two-factor authentication solutions, and developers can easily implement support for passkey logins.
Access keys currently only work with Apple devices, so Apple is talking to partners at FIDO and the World Wide Web Consortium about a broader solution that would allow users to remove passwords on non-Apple devices.
Passwords in iOS 15 and macOS Monterey are intended for testing and not for production accounts, as Apple is still testing this feature. Apple is allowing developers to test passwords as part of a multi-year effort to replace passwords.
The emphasis of this advance is on authentication technology, a WebAuthn implementation supported by iCloud Keychains. An industry-wide transition from passwords will require thoughtful and consistently applied design patterns, which are not part of this preview.
Notice to the conference to set expectations for the displayed technology
Passwords can be viewed in more detail in Apple's full WWDC “Go Beyond Passwords” session.
