GitHub has announced the arrival of its passkeys public beta for passwordless authentication, which the company says will enable seamless and secure access on GitHub.com.
The move will allow users to upgrade their security keys to passkeys to be used in place of both passwords and two-factor authentication (2FA) to bolster overall account security.
In an announcement, the firm explained that most security breaches involve lower-cost attacks such as social engineering, credential theft, or leakage.
According to data from the FIDO Alliance, the team behind the global authentication standard based on public key cryptography, passwords are estimated to be the root cause of over 80% of data breaches globally.
To tackle this, GitHub said its new passkeys bring easier configuration and enhanced recoverability, providing a secure and private way to protect accounts and minimize the risk of lockouts.
“GitHub is committed to helping all developers employ strong account security while staying true to our promise of not compromising their user experience,” said Hirsch Singhal, staff product manager at GitHub. “We began this commitment with our 2FA initiative across GitHub.
“Today, we are furthering this work by ensuring seamless and secure access on GitHub.com with the public beta of passkey authentication.”
Users can implement passkeys via the ‘Feature Preview’ tab in the settings sidebar, which now displays an option to ‘enable passkeys’. This will enable the option to upgrade eligible security keys to passkeys, as well as register new passkeys.
How GitHub passkeys work
The new passkeys essentially count as two security layers in one, combining a user element such as a thumbprint, face, or knowledge of a PIN, with a physical element such as a security key or device.
Due to expanded browser support, GitHub said a browser’s autofill system can automatically suggest that users use their passkey to sign in straight from the login page – regardless of whether a user has 2FA enabled.
RELATED RESOURCE
The state of email security 2023
Discover how leaders are protecting their organizations from cyber attacks in the face of increases in email usage.
Passkeys can also be used across more than just the device they were created on, thanks to a new experience labeled ‘Cross-Device Authentication’.
This allows the use of a passkey on a phone to sign into a laptop, for example, by verifying the phone’s presence.
“Because your phone or tablet must be physically close to your laptop or desktop, Cross-Device Authentication retains the phishing-resistant promise of FIDO,” Singhal said.
Additionally, many passkeys can be synced across multiple devices to help prevent account lock-out due to key loss. This can be done automatically, depending on passkey provider, GitHub said.
How to upgrade
Existing user security keys that are capable of verifying identity – such as Touch ID, Windows Hello, Android thumbprints, or PIN-locked or biometric hardware keys – are eligible to be upgraded.
Upon next sign in with the security key, GitHub will ask users if they would like to upgrade to a passkey. This will then re-register the security key with the user’s passkey provider to ensure it is discoverable during authentication and synced. Up-to-date devices support passkeys straight out of the box.
“Because passkeys are privacy-preserving, you might have to trigger your passkey a few times during that upgrade flow so we can make sure we’re upgrading the right credential,” Singhal said. “Once you do, you’re all set for a passwordless experience.
“By registering durable, secure credentials across all your devices, we hope to prevent account lockouts due to device loss,” Singhal added.
-
Westcon-Comstor and Vectra AI launch brace of new channel initiativesNews Westcon-Comstor and Vectra AI have announced the launch of two new channel growth initiatives focused on the managed security service provider (MSSP) space and AWS Marketplace.
-
Third time lucky? Microsoft finally begins roll-out of controversial Recall featureNews The Windows Recall feature has been plagued by setbacks and backlash from security professionals
-
Organizations urged to act fast after GitHub Action supply chain attackNews More than 20,000 organizations may be at risk following a supply chain attack affecting tj-actions/changed-files GitHub Action.
-
Nearly a million devices were infected in a huge GitHub malvertising campaignNews Microsoft has alerted users to a malvertising campaign leveraging GitHub to infect nearly 1 million devices around the world.
-
'GitVenom' campaign uses dodgy GitHub repositories to spread malwareNews Security researchers have issued an alert over a campaign using GitHub repositories to distribute malware, with users lured in by fake projects.
-
I love magic links – why aren’t more services using them?Opinion Using magic links instead of passwords is safe and easy but they’re still infuriatingly underused by businesses
-
Malicious GitHub repositories target users with malwareNews Criminals are exploiting GitHub's reputation to install Lumma Stealer disguised as game hacks and cracked software
-
Password management startup Passbolt secures $8 million to shake up credential securityNews Password management startup Passbolt has secured $8 million in funding as part of a Series A investment round.
-
LastPass breach comes back to haunt users as hackers steal $12 million in cryptocurrencyNews The hackers behind the LastPass breach are on a rampage two years after their initial attack
-
A leaked GitHub access token could have led to a catastrophic supply chain attackNews The GitHub access token with administrator level privileges could have been used to great effect by threat actors
