Project ECHAE

Photo by Walls.io on Pexels So Your Bank Is Suddenly Asking You to "Set Up a Passkey" You log into some app you use every week and there's a new banner: "Sign in faster with a passkey." Maybe there's a little fingerprint icon next to it. You click "not now" because you're busy, and then it shows up again next week. And the week after that. I put this off for months too. Not because I doubted it worked, but because every explainer I found either assumed I already understood public-key cryptography or waved it away with "it's just like Face ID, but for websites!" That's technically true and completely unhelpful. So here's the version I wish someone had given me, including the one step that actually matters and that most guides skip entirely. What a Passkey Actually Is (Skip the Jargon) Forget the cryptography lecture. Functionally, a passkey replaces a password with something tied to your device — your phone'...

Photo by Walls.io on Pexels Your phone has been quietly asking you to do this for months You've probably seen the prompt. You log into some app, and instead of the usual password box, there's a little popup asking if you want to "create a passkey" or "sign in faster next time." Most people tap "not now" and move on with their day. I did the same thing for longer than I'd like to admit, mostly because nobody explains what a passkey actually is before asking you to adopt one. So here's the short version: a passkey replaces your password with your fingerprint, face, or device PIN. No password to type, no password to forget, and — this is the part that matters — nothing for a phishing site to steal, because there's no password sitting on a server somewhere waiting to leak. I've been testing this shift across my phone, laptop, and a handful of accounts for a while now, and it's one of the few security upgrades that's a...

Photo by Walls.io on Pexels You've Probably Seen the Prompt Already If you've logged into Google, Amazon, or your bank app recently, you've probably seen a little popup asking if you want to "create a passkey" or "sign in faster next time." Most people tap "not now" and move on, mostly because nobody explains what they're agreeing to. I did the same thing for months. Then I actually sat down and set one up properly, and I've been slowly replacing passwords ever since. This isn't one of those speculative "future of security" pieces. Passkeys are already live on most major services, they work today on the phone in your pocket, and they solve a real problem: passwords are terrible, and you know it. You reuse them, you forget them, you get phished by fake login pages that look exactly like the real thing. A passkey fixes a good chunk of that, but only if you set it up in a way that doesn't strand you the moment y...

Photo by Walls.io on Pexels So What Is a Passkey, Really? I put off setting up passkeys for months because every explanation I read made it sound like a cryptography lecture. Public key pairs, authenticators, attestation — my eyes glazed over. Then I finally sat down and turned one on for my Google account, and it took about ninety seconds. No password typed, no code texted to my phone. Just a Face ID prompt and I was in. A passkey is basically a login that lives on your device instead of in your head. When you set one up, your phone or laptop creates a matching pair of digital keys — one stays locked on your device, the other gets stored by the website. To log in, your device proves it has the private half using whatever unlock method you already use: Face ID, a fingerprint, or your screen PIN. Nothing gets typed, and nothing gets sent over the internet that a hacker could intercept or a leaked database could expose. I've written before about setting up my phone's voice ...