Explain it to me, please: Pass Codes

Apr 27, 2026 Last reply: 2 months ago 27 Replies

Let me have a go...

Passkeys use public key cryptography, in that you have private and public keys. This means you can sign messages where the other side can check the signature, but couldn't forge your signature themselves.

As a rough analogy, think about writing a cheque. A cheque says: "Dear Barclays, please pay Bill Smith ten pounds. Yours J. Jones"

and it's based on something you have (a chequebook - nobody should be able to forge it) and a signature (something that another person can't reproduce). If somebody steals one piece they can't reproduce the other piece - if someone steals your blank cheques they can't forge your signature, and if they copy your signature they don't have your chequebook to make valid cheques. (in theory, anyway)

With public key crypto, 'signing' means using your private key to provide checkable proof that you are who you say you are, in a way that the recipient can check but can't forge.

Doing that with passkeys has two steps:

  1. Unlock the passkey with something (fingerprint, PIN, passphrase, face, etc)
  2. Use the unlocked passkey to sign a challenge from the website.

So what happens is you set up a passkey with a certain website. To login, your computer then prompts for (let's say) a PIN. This PIN is only used to unlock the passkey stored on your machine - it's not sent to the other end. If successfully unlocked, you can sign the challenge with your passkey in a way that the other end can safely check, and if the checks pass you're logged in.

The other thing that passkeys do is they are specific to a particular website. You can't ask Lloyds to pay a cheque that's drawn on a Barclays account. For passkeys, the cryptography will fail if used on the wrong website, and a fake website can't use that failed login to try to login to the real website so phishing is stopped. This also prevents password sharing between different websites (even if you use the same PIN, the websites don't see it).

Therefore what you're doing is storing perhaps one key pair for every website on your computer, rather than a bit of paper with a password for that website. Each key pair has a way to 'unlock' it on your machine before you can use it. Sometimes this 'unlock' mechanism involves a second device

- eg most desktops don't have fingerprint readers, but there's a way for the desktop browser to talk to the fingerprint reader on your phone to unlock. This stuff is optional - you can just use a PIN to lock your keys if you don't mind the reduced security.

The next problem comes when you have multiple machines - perhaps a desktop, a laptop, a phone, a tablet. If you login on your desktop you'd quite like to be able to login on your tablet as well. This means there are various methods to sync passkeys between different devices. To begin with this was heavily cloud-based: if you have passkeys in your Apple Keychain then you can use them on your Mac and on your iPhone. Microsoft and Google have similar systems for their 'ecosystems'.

This caused some lockin: you couldn't extract the key from your iPhone to use on your Android. Sometimes websites would let you set up multiple passkeys for your account (one for login from iPhone, one for Android), but not always. But more recently sync protocols have developed that allow syncing between different platforms (I'm not up to date where that stands currently). Another way to do it is to use a password manager that can be installed across your devices of different brands, that keeps hold of your passkeys and permits syncing between the devices.

Finally, passkeys work like better passwords. But not all websites are using them that way. For example, some are removing the credential reset procedures (sending an email with a link to reset your password) 'because it makes it more secure and you should backup your passkeys', but that puts the onus on the user to do that. If you lose your passkeys you may find that some websites lock you out because they don't have a way to verify you. In the case of Barclays there would always be a 'visit a branch with your passport' kind of fallback if you lose your login details, but some Big Tech companies don't want to implement that kind of flow (physical identity checking costs money) - no passkey and no recovery codes means you are locked out of your account forever. This is something to watch out for when enabling passkeys.

Theo

Thus replacing a password (usually minimum 8 characters including alphas, digits and symbols) with a 4 (or 6) digit PIN? Not an improvement in security.

I mention this because my main PC lacks both camera and fingerprint reader (which is my preferred situation).

The trick is that the PIN/whatever never leaves the client computer, it is only used locally to decrypt the private key. Secure Shell has done this for decades, using a key decryption password as long as you like.

I've always wondered about biometrics: what do you do when (*not* 'if') you get hacked? Get a fingerprint transplant?

The other thing that isn't clear to me: who generates the public/private key pair, and if it isn't done on your computer, how is the private key transmitted to you securely? It would seem obvious that you should generate the keys and send the public key, as SSH does, but I haven't seen that explicitly stated.

Depends what you're using, Windows Hello PINs can be alphanumeric and longer than 4 symbols, it's only protecting the local request to agree the passkey request, not usable by remote hackers.

It is.

formatting link

My bank uses a completely different method. I have an identifier that was sent to me in a letter, so that nobody should know it apart from me and my bank. I log into my account using that identifier and some characters from my Debit Card PIN (not the whole pin just chosen randomly selected positions in the pin). Then I have to put the same debit card into a supplied card reader, having told the banking system what the last four characters of my debit card are. The bank system presumably checks that my account does have a debit card with those numbers. I then press an Identify Me button on the card reader and it asks me to put my complete PIN in (this is an offline device so that even if my computer is exporting my keyboard characters it can't see the completely independent card reader).

Presumably using some mathematical wizardry it uses something on the card in the reader and something else that the bank system has also calculated to generate an 8 character one-time password that I have to key into the bank system within about 90 seconds before it expires, and then I can access my account properly.

The beauty of that arrangement is that it only uses information that my bank knows is on my debit card, a card reader supplied by my bank, and the physical card that I have put into the reader. If the card gets lost or stolen then the new and unauthorised owner still doesn't know the magic number sent in the post to me that identifies the account information that the bank system is going to use to match the one-time password generated offline.

That surely makes it slightly more bullet-proof than a pass code that is always going to be online in order for it to be used?

This system works, roughly speaking, the same as passkeys. Your card contains a private key, you put the card into the reader and unlock the private key with your PIN. Then the bank sends you a message (those numbers you type into the card reader - account number, amount, etc) which you sign with your private key and send back (part of) the signature. The bank has your key[*] so can check the signature is valid. If anyone steals your card they don't know your PIN, and if you tell someone your PIN they don't have your card. The card readers have no secrets in them and are interchangeable between banks using the scheme.

Passkeys use the same principle with public key crypto but designed for logging into websites not authenticating banking transactions. The private keys are stored on your computer/phone/tablet/etc rather than offline on the card - this is to make logging in less hassle.

There are passkey implementations which require use of an external device that holds the keys (typically a USB dongle but you can even use a smartcard just like your bank does) but they're typically used in high security business environments. The more common consumer implementations (optionally) use an unlocking step with another device you already have (eg a phone to login to on your laptop, or a smartwatch to login on your phone) to guard against the problem of someone hacking/stealing your primary device and getting your private keys.

Theo

[*] I think EMV (chip and PIN) and CAP (those calculator widgets for online banking) are actually using symmetric crypto where the keys are shared between the bank and the card, because doing public key crypto on cheap smartcards is/was too slow. I'm not up to date as to whether things have moved on in the last ~15 years since I last worked in this area.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required