Exposing the Security Gap: Companies That Refuse to Offer Passkeys

Despite the growing consensus on the superiority of passkeys for account security, a significant number of major online services still don't offer this option to their users. A new website, whynopasskeys.com, has taken it upon itself to call out these companies, including household names like Instagram, Netflix, and Spotify. The brainchild of veteran security researcher Scott Helme, the site aims to encourage these businesses to adopt passkeys by publicly listing those that haven't. So, what makes passkeys so secure? For starters, they're generated by a user's device and are specific to both the device and the website they're created for. They can also utilize biometric authentication methods like Face ID or Touch ID, and are often stored automatically in a user's password manager. This means that, unlike traditional passwords, passkeys don't require users to memorize anything, making them much harder for hackers to obtain. Helme believes that shame can be a powerful motivator, and his site is designed to push companies to give their users the option to switch to passkeys. On the other hand, tech giants like Apple, Google, and Microsoft have already made the switch, offering passkeys to their users. Interestingly, while Instagram doesn't offer passkeys as a standalone option, users can enable them if their account is linked to a Facebook account with passkeys already set up. As the situation develops, it will be worth watching to see how these companies respond to the pressure to improve their security measures.