Full Report
Passkeys promise fewer phishing headaches – and £600 a day off Whitehall's SMS bill
Analysis Summary
# Best Practices: Passkey Adoption and Passwordless Authentication
## Overview
These practices address the transition from traditional knowledge-based authentication (passwords) and SMS-based multi-factor authentication (MFA) to **passkeys** (FIDO2/WebAuthn). This shift aims to eliminate phishing risks, improve user experience, and reduce operational costs associated with SMS gateways.
## Key Recommendations
### Immediate Actions
1. **Enable Passkey Support:** If using GOV.UK One Login or similar identity providers, activate the passkey option in security settings.
2. **Audit SMS Costs:** Identify the daily expenditure on SMS-based 2FA to build a business case for passwordless migration.
3. **User Communication:** Inform users that they can now use biometric (Face ID, Fingerprint) or device PINs to log in, highlighting the "8x faster" speed improvement.
### Short-term Improvements (1-3 months)
1. **Promote "Phishing-Resistant" MFA:** Update internal security policies to prefer passkeys over SMS or TOTP (authenticator apps).
2. **Device Compatibility Check:** Ensure fleet devices (mobile and desktop) support biometric sensors or secure enclaves (TPM) required for passkeys.
3. **Support Desk Training:** Prepare help desk staff for common passkey queries, such as "What happens if I lose my device?" and how to register a backup key.
### Long-term Strategy (3+ months)
1. **Phased Password Deprecation:** Gradually move toward a "password-optional" environment where passkeys are the primary credential.
2. **Unified Identity Management:** Consolidate disparate login systems into a single identity provider (like One Login) to centralize credential management.
3. **Cost Reallocation:** Redirect savings from SMS billing (approx. £600/day for large entities) into proactive threat hunting or security infrastructure.
## Implementation Guidance
### For Small Organizations
- **Leverage Third Parties:** Do not build your own passkey infrastructure. Use established providers (Google, Microsoft, Apple, or GOV.UK One Login) that already support WebAuthn.
- **Focus on Speed:** Market the change to employees as a time-saver rather than just a security requirement.
### For Medium Organizations
- **Incentivize Adoption:** Use "nudges" in the login flow to suggest passkey registration after a successful password login.
- **Hybrid Support:** Maintain legacy MFA (like TOTP) as a fallback while promoting passkeys as the "Gold Standard."
### For Large Enterprises
- **Centralized Identity Provider (IdP):** Implement a single sign-on (SSO) solution that supports FIDO2 to cover all government or corporate services.
- **Cryptographic Policy:** Ensure that the cryptographic credentials generated are tied to specific domains to prevent "man-in-the-middle" (AiTM) phishing attacks.
## Configuration Examples
While specific code is not provided in the article, the implementation follows the **WebAuthn (FIDO2)** standard:
- **Attestation:** The server requests a credential from the device.
- **Authenticator:** The user unlocks their device (Biometric/PIN).
- **Assertion:** The device sends a signed cryptographic assertion back to the server, verifying the user's identity without sending the biometric data itself.
## Compliance Alignment
- **NCSC Guidelines:** Aligns with the UK National Cyber Security Centre’s recommendation for phishing-resistant authentication.
- **FIDO2 / WebAuthn:** Adheres to World Wide Web Consortium (W3C) standards for secure web authentication.
- **GDPR/Data Privacy:** Biometric data (Face ID/Fingerprint) remains on the local device and is **not** stored or seen by the service provider.
## Common Pitfalls to Avoid
- **Forced Migration:** Avoid disabling passwords immediately; allow an optional transition period to prevent user lockouts.
- **Single Point of Failure:** Ensure users are encouraged to register more than one passkey (e.g., a phone and a laptop) to maintain account access if a device is lost.
- **Misunderstanding Biometrics:** Clarify to users that the government/company is *not* collecting their fingerprints; they are only receiving a cryptographic "OK" from the device.
## Resources
- **NCSC Guidance:** hxxps[:]//www[.]ncsc[.]gov[.]uk/guidance/multi-factor-authentication-mfa
- **FIDO Alliance:** hxxps[:]//fidoalliance[.]org/passkeys/
- **GOV.UK One Login:** hxxps[:]//www[.]gov[.]uk/government/news/millions-of-people-to-benefit-from-simpler-more-secure-way-to-sign-in-to-government-services