Digital Transactions Authoritative, insightful and timely information for payments professionals
PayPal Holdings Inc.’s next step in payment security is to replace passwords with passkeys, an authentication technology that could eliminate many security and practical issues for consumers and organizations alike.
PayPal said it is adding the passkey technology—it uses cryptographic keys to identify devices and was developed by the FIDO Alliance and the World Wide Web consortium—to PayPal.com on iPhone, iPad, and Mac devices made by Apple Inc., with support for more platforms to come. The FIDO Alliance, a Wakefield, Mass.-based nonprofit, helped developed passkeys to reduce use of password-based authentication.
Passkeys, the alliance says, are resistant to phishing, reliably strong, and are designed so there are no shared secrets. Google also supports passkeys in its Android operating system, and Microsoft Corp. intends to support the technology in 2023.
Many consumers will give up trying to access an online service if they can’t recall a password. In the United States, only 42% of respondents in a recent FIDO Alliance survey said they never gave up accessing an online service after failed attempts to recall their passwords.
PayPal says its passkeys, once created, are synced with Apple’s iCloud Keychain, a secure credential-storage service, to help make them easier to use on iOS16, iPadOS 16.1, and macOS Ventura devices.
The passkey setup works like this: An existing customer logs into PayPal.com with their existing PayPal credentials and is presented with an option to “create a passkey.” Should they proceed, the user will be asked to authenticate with Apple Face ID or Touch ID. The passkey will be automatically created. On the next visit to PayPal that requires a log in, the passkey will be used, eliminating the need to use or manage a password.
On devices that don’t support passkeys yet, the consumer can use an iPhone to scan a Quick Response code that appears after entering PayPal user-ID credentials.
PayPal, in a statement, says passkeys will help improve the checkout experience by eliminating the risks of weak and reused credentials and doing away with remembering a password.
