Passkeys are being rolled out across GOV.UK One Login, for accessing government services online. A passkey lets people sign in using their fingerprint, Face ID or PIN instead of a password.
Digital Government Minister at the Department for Digital, Culture, Media and Sport (DCMS) Stephanie Peacock said: “Nobody enjoys hunting for a forgotten password or waiting for a text message code just to check their tax return or renew a document. Passkeys mean people can access the services they rely on in seconds, using the same fingerprint or face scan they already use to unlock their phone. This is about making government services simpler and safer for everyone, while giving people stronger protection against the fraudsters who target passwords.”
GOV.UK One Login provides access to such government services as checking a state pension, managing tax services and renewing a driver’s licence.
NCSC recommends
The UK official National Cyber Security Centre (NCSC) recommends passkeys as a more secure alternative to passwords, because they can’t be intercepted, reused or stolen. Jonathon Ellison, NCSC Director for National Resilience said: “The introduction of passkeys for GOV.UK One Login will give users a faster, simpler and more secure way to sign in to many public-facing government services while leaving password headaches behind. Cyber criminals often look for the easiest route to access important accounts, which means login details remain a common target. But passkeys offer a highly phishing-resistant alternative to passwords, frustrating attackers and saving the public time. We strongly encourage users to set up a passkey for GOV.UK One Login and to do so wherever passkeys are available across digital services. By taking this small but significant step, you can help protect your online accounts and raise our collective resilience, making the UK safer.”
Comment
Nic Sarginson, principal product manager at passkey vendor Yubico, says: “We are currently witnessing a global transition where both enterprises and users are moving away from passwords towards stronger, more resilient authentication technologies. The Government’s passkey rollout across its digital services comes at a critical time as organised crime groups are increasingly turning to AI to supercharge their scams, enabling highly sophisticated and convincing forms of fraud.
“With 81 percent of hacking-related breaches stemming from weak or reused passwords, it is clear that passwords are an out-of-date and fundamentally flawed method of security designed for an Internet not prepared for the cyber attacks of today. The UK Government’s endorsement of passkeys – citing them as the recommended method for enhanced security** – helps cement their place in providing the future of secure authentication.
“Physical passkeys are rapidly emerging as the new standard for secure authentication. In its most secure form, a passkey is device-bound – meaning it is stored on a local device like a physical hardware security key instead of on a remote server like passwords. These cryptographic keys are bound to the device and pair a public key with an unguessable private key which is never shared, meaning remote attackers are unable to intercept them. Rather than depending on something a user has to remember – which can easily be forgotten, stolen or phished – a passkey relies on something they have (the physical key), something they know (a PIN), and something that proves the identity of the user who is supposed to gain access (a physical touch of the key). Crucially, if a user is tricked into clicking a link and lands on a fraudulent website, the passkey simply won’t authenticate the login attempt, stopping the attacker in their tracks.”
