John
(he/him)
One of the necessary evils for cybersecurity and online hygiene nowadays is to require Multi-Factor Authentication. This is on by default on this forum, requiring you to connect a Time-based One Time Password (TOTP) authenticator, which gives you the 6 digit code to pair with your password. This can be burdensome if people don't login often, and be a deterrent for return visits.
What if I said there was a better way? A way without a password, or random numbers? One that can log you in with as little as a button press? Introducing: Passkeys.
In the top right corner of the Password and Security section of your account, there's a box to "Add passkey". This creates a key pair, a public one on the website, and a private one that is stored either in a cell phone's secure enclave or on something like a Yubikey dongle. It supplants your password, turning that into a fallback / secondary access method.
Once you have a passkey generated and saved to a container, a new login option awaits you.
If you click that button for Passkey (on Windows, haven't tried on Mac so don't know if it's different), you get a popup to look for the passkey either on a security key like a Yubikey or from a cell phone. If you pick the phone, a special QR code comes up. Scan that with your phone with the passkey, click a button on the phone saying you're aware you're logging in, and done. It uses whatever security features you've enabled on your phone as proof that you are who you are, so fingerprint, facial recognition, or phone lock code. No password to enter on the website, no 6 numbers to check, it's all offloaded to your phone.
If you're logging in from the same device that holds the passkey, it's even easier. No switching devices, just do the device checks and you're in.
Good luck!
What if I said there was a better way? A way without a password, or random numbers? One that can log you in with as little as a button press? Introducing: Passkeys.
In the top right corner of the Password and Security section of your account, there's a box to "Add passkey". This creates a key pair, a public one on the website, and a private one that is stored either in a cell phone's secure enclave or on something like a Yubikey dongle. It supplants your password, turning that into a fallback / secondary access method.
Once you have a passkey generated and saved to a container, a new login option awaits you.
If you click that button for Passkey (on Windows, haven't tried on Mac so don't know if it's different), you get a popup to look for the passkey either on a security key like a Yubikey or from a cell phone. If you pick the phone, a special QR code comes up. Scan that with your phone with the passkey, click a button on the phone saying you're aware you're logging in, and done. It uses whatever security features you've enabled on your phone as proof that you are who you are, so fingerprint, facial recognition, or phone lock code. No password to enter on the website, no 6 numbers to check, it's all offloaded to your phone.
If you're logging in from the same device that holds the passkey, it's even easier. No switching devices, just do the device checks and you're in.
Good luck!