Passkeys, biometrics, and where to keep your 2FA

Passkeys beat passwords

A passkey is a key pair tied to one website. The site keeps only the public half, so a breach of that site leaks nothing an attacker can use, and a passkey cannot be phished because it only works on the real site. Use passkeys wherever they are offered. Where they are not, use a long unique password and a second factor.

Passkeys stored in a password manager like Bitwarden sync across your devices and are a large step up from passwords. They are then only as strong as your vault, so for your most important accounts a hardware key, which never lets the key leave the device, is stronger again.

Biometrics depend on what you are unlocking

There are two situations here, and they are not the same.

Unlocking your own phone with a modern sensor, such as Apple's Face ID or a fingerprint reader backed by secure hardware, holds up well against the attack people worry about, where someone builds a fake of you from photos found online. The sensor sees the real scene in front of it, in three dimensions, and you cannot feed it a video. Getting past it needs physical presence and a purpose-built physical fake, not your data. The weak exception is the cheap flat-image face unlock on some phones, which a photo can fool, so use a fingerprint or a PIN on those instead.

Proving your identity to a service over the internet, by taking a selfie or a short video, is a different story. AI face-swaps combined with a fake camera feed now defeat many of these checks, blinking and turning on command, and it is a fast-growing kind of fraud. So a face is weakening as proof of identity online, even while a face or fingerprint is still reasonable to unlock your own device.

Two things stay true either way. A biometric is a convenience unlock sitting on top of your PIN, which is the real lock, so keep a strong PIN. And you cannot change a fingerprint or a face if it is ever copied, and in many places you can be made to unlock with one more easily than with a passcode. When it really matters, treat the PIN as the stronger lock.

Where to keep your 2FA

Storing your login codes in the same vault as your passwords is convenient, and it still protects you against the most common attack, a website breach leaking your password. It has a cost though: both factors now sit behind one master password, so if your vault is ever opened, the attacker has both.

The fix is to tier it:

• Everyday accounts: keeping the codes in Bitwarden is fine.
• Your email, your password manager itself, and anything holding money: keep the second factor separate, in a standalone authenticator such as Aegis or Ente Auth, or on a hardware key, and keep the recovery codes out of the vault as well.

One note on the tools. Bitwarden Authenticator, the separate app, is a different basket from your passwords. Codes stored inside the main Bitwarden vault are the same basket. That difference is the whole point.