South Africans have become used to excellent in-app security when it comes to banking and other online transactions. Looking ahead, passkey technology will mean we could soon enjoy the same unphishable, biometric-based solution in the browser, boosting consumer confidence and helping foster digital adoption.
“As banking apps have become more secure, fraudsters have naturally looked to exploit the weakest link which, at the moment, is a combination of the browser and users being overly trusting. The usual username and password for browser login can easily be phished and fast talking social engineering can even dupe unsuspecting users into sharing OTPs with fraudsters. Fortunately, passkey technology is proving to be an easily deployed way to bring unphishable biometric-based security to browsers as well,” shares Arno van der Merwe, product manager: browser experience at Entersekt.
Passkeys are a digital credential tied to a user account and a website or app. They rely on biometrics such as fingerprints (such as TouchID), facial recognition (such as FaceID), or sometimes a PIN (such as Windows Hello), to authenticate a user. This removes the need for complex, and often easily forgotten passwords. In addition, because they are stored locally on a device and not on a server, even if a website or app is breached, they remain out of the hackers’ reach.
Passkeys can also be used and synced between devices, allowing users to keep them when they upgrade phones or computers and removing the need to remember different passwords for different websites or apps.
“South Africans are conditioned to see the mobile application as being secure. Our phones are tied to us as a unique identifier, while browsers could be launched from any computer anywhere in the world and lack that strong authentication identifier. While apps on mobile phones are by no means invincible, it’s much harder to take over someone’s account by taking over an app, than it is to go into the front door on the browser where they don’t need much identification,” Van der Merwe explains.
Fido authentication or passkey authentication is a fairly new authentication method, but has enjoyed strong adoption, especially in the US over the past few years.
“Passkeys have gained a lot of traction over the last few years, especially since Google, Apple, and Microsoft have all announced support for the technology. The US has been particularly keen to adopt passkey authentication, probably because US consumers are less fond of apps than many customers in Europe and even South Africa. We already have multiple US credit unions making use of passkey technology and, with around 80% of operating systems able to support the technology, this is likely to quickly grow over the next year or two,” Van der Merwe says.
However, Van der Merwe says there is a strong use case for passkeys in South Africa, especially when it comes to creating a seamless authentication experience across all digital channels.
“It will be really easy for local banks to implement passkeys since we offer it as a SaaS model and, because many users are already using biometric authentication on their devices, there won’t have to be too much user education. What’s more, the payments industry is very keen to embrace this method and the EMVCo 3DS 3.2.1 spec has had changes specifically tailored to allow passkey authentication as part of 3D Secure Payments,” he says.
Van der Merwe says local banks are especially keen on the technology because it is relatively low friction compared to out of band solutions, but still provides strong cryptographic proof of user presence and consent. Passkeys are also non phishable and don’t pose the same complexity of sending a SMS OTP to an out of band device.
“This is collectively putting in place everything we need from a technical and regulatory standpoint to start using passkeys as the primary authentication mechanism, even in ecommerce transactions, as we move into 2024,” he predicts.