South Africans have become used to excellent in-app security when it comes to banking and other online transactions. Looking ahead, passkey technology will mean we could soon enjoy the same unphishable, biometric-based solution in the browser; boosting consumer confidence and helping foster digital adoption.
“As banking apps have become more secure, fraudsters have naturally looked to exploit the weakest link, which, at the moment, is a combination of the browser and users being overly trusting. The usual username and password for browser login can easily be phished, and fast-talking social engineering can even dupe unsuspecting users into sharing OTPs with fraudsters. Fortunately, passkey technology is proving to be an easily deployed way to bring unphishable biometric-based security to browsers as well,” shares Arno van der Merwe, Product Manager: Browser Experience at Entersekt.
Passkeys are digital credentials tied to a user account and a website or app. They rely on biometrics such as fingerprints (TouchID), facial recognition (FaceID), or sometimes a PIN (Windows Hello) to authenticate a user. This removes the need for complex, and often easily forgotten passwords. In addition, because they are stored locally on a device and not on a server; even if a website or app is breached, they remain out of the hackers’ reach.
Passkeys can also be used and synced between devices, allowing users to keep them when they upgrade phones or computers and removing the need to remember different passwords for different websites or apps.
“South Africans are conditioned to see the mobile application as being secure. Our phones are tied to us as a unique identifier, while browsers could be launched from any computer anywhere in the world and lack that strong authentication identifier. While apps on mobile phones are by no means invincible, it is much harder to take over someone’s account by taking over an app, than it is to go into the front door on the browser where they do not need much identification,” Van der Merwe explains.
US leading the way, but SA is set to follow
Fido authentication, or passkey authentication, is a fairly new authentication method, but it has enjoyed strong adoption, especially in the US over the past few years.
“Passkeys have gained a lot of traction over the last few years, especially since Google, Apple, and Microsoft have all announced support for the technology. The US has been particularly keen to adopt passkey authentication, probably because US consumers are less fond of apps than many customers in Europe and even South Africa. We already have multiple US credit unions making use of passkey technology and, with around 80% of operating systems able to support the technology, this is likely to quickly grow over the next year or two,” Van der Merwe says.
However, Van der Merwe says that there is a strong use case for passkeys in South Africa, especially when it comes to creating a seamless authentication experience across all digital channels.
“It will be really easy for local banks to implement passkeys since we offer it as a SaaS model and, because many users are already using biometric authentication on their devices, there will not have to be too much user education. What is more, the payments industry is very
keen to embrace this method, and the EMVCo 3DS 3.2.1 spec has had changes specifically tailored to allow passkey authentication as part of 3D Secure Payments,” he says.
Van der Merwe says local banks are especially keen on the technology because it has relatively low friction compared to out-of-band solutions, but still provides strong cryptographic proof of user presence and consent. Passkeys are also unphishable and do not pose the same complexity as sending an SMS OTP to an out-of-band device.
“This is collectively putting in place everything we need from a technical and regulatory standpoint to start using passkeys as the primary authentication mechanism, even in e-commerce transactions, as we move into 2024,” he predicts.
For more information, visit entersekt.com
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version