NCSC Urges Consumers to Choose Passkeys Over Passwords
Summary
The NCSC recommends passkeys as consumers’ first choice where available, citing stronger protection against phishing and stolen credentials. Its guidance advises password managers and two-step verification as fallbacks and stresses secure storage and recovery.
Key points
- The NCSC recommends passkeys as consumers’ first choice for logging into services that support them.
- The agency says passkeys offer stronger protection against phishing and stolen credentials than passwords.
- The NCSC published technical guidance on passkey benefits, password risks, and secure implementation.
- Where passkeys are unavailable, the NCSC recommends a password manager and continued use of two-step verification.
- Organizations should plan how passkeys will be stored and how users can recover access if credentials are lost, deleted, or corrupted.
Article Details
- Event Type
- National cybersecurity guidance recommending passkeys as consumers’ first choice for authentication
- Impact
- The NCSC says passkeys provide stronger protection against phishing and stolen or compromised credentials than passwords. Where passkeys are unavailable, it recommends password managers and two-step verification. Organizations are advised to plan for passkey storage and account recovery.
People
Vendors
GoogleOrganizations can enable passkeys via providers like Microsoft, Google and Okta and must plan for storage and recovery (device, cloud manager, or hardware tokens such as YubiKey).MicrosoftOrganizations can enable passkeys via providers like Microsoft, Google and Okta and must plan for storage and recovery (device, cloud manager, or hardware tokens such as YubiKey).OktaOrganizations can enable passkeys via providers like Microsoft, Google and Okta and must plan for storage and recovery (device, cloud manager, or hardware tokens such as YubiKey).