Passwords, Passkeys and Quantum Computing: The Saga of Logging In

Quick Summary

• Traditional passwords are becoming less secure due to poor user habits and cyber threats.
• Multi-Factor Authentication (MFA) improves security but has its limitations.
• Passkeys offer a passwordless future, using biometrics and cryptographic key pairs.
• Users should use password managers, unique passwords, and MFA while transitioning towards passkeys.
• Quantum computing could threaten current authentication methods, but post-quantum cryptography is in development.

---

The fast-paced nature of the digital world is not slowing down but speeding up. Technology is evolving at a staggering rate, with AI and quantum computing moving from the realms of science fiction to reality. Sometimes it can really feel like we’re living in the future.

Predictably, cyber criminals, and even state actors, are trying to use the power of these new technologies to steal your data, money and identity. One of the easiest ways for them to do that is by cracking or accessing your passwords. In this article we’ll delve into the latest developments that have moved us from reusing “password123” on every website through to biometric passkeys and military-grade encryption.

Passwords Episode 1: Traditional Passwords

For years, cyber security experts have advised using strong, unique passwords. However, remembering complex passwords is challenging, leading to bad habits such as password reuse or writing them down. Although, ironically, printing MFA backup codes is advisable if you can keep them physically secure.

To improve security, guidance has shifted away from mandatory password changes and towards tools like Multi-Factor Authentication (MFA) and password managers. But despite these measures, traditional passwords remain a weak link in cyber security.

Best Practices for Managing Passwords: To enhance security, users should:

• Use Unique, Complex Passwords:
• Leverage a Password Manager: They can securely generate and store complex passwords.
  • You MUST secure your password manager with a strong master password and MFA.
• Avoid Personal Information Within Your Passwords.
• Enable Multi-Factor Authentication (MFA): Most online accounts that hold personal info have this feature available.

While these practices improve security, they are not foolproof and present their own challenges.

Pitfalls in Authentication

Even with extra security measures, authentication methods have weaknesses:

• Losing Access to Authentication Devices: Losing a phone could mean being locked out of accounts.
• SIM-Jacking Attacks: Hackers trick telecom providers into transferring a victim’s phone number, intercepting SMS authentication codes.
• Inconvenience of Hardware Tokens: While effective, they can be lost or forgotten.

These issues highlight the need for a more secure and user-friendly authentication method.

Passwords Episode 2: The Rise of Passkeys

Tech giants like Apple, Google, and Microsoft are championing passkeys, aiming to replace passwords entirely. Passkeys use cryptographic key pairs stored on a user’s device, allowing authentication through biometrics (e.g., Face ID, fingerprint) or a device PIN.

How Passkeys Work

1. A unique cryptographic key pair is created on a device.
2. The private key remains securely stored on the device.
3. Authentication occurs via biometric data or a PIN, eliminating passwords.
4. The public key verifies the authentication request.

Advantages:

• No Passwords to Remember: Which is appealing to most users.
• Phishing Resistance: There is no way for a user to expose their credentials.
• Cross-Device Synchronisation: You can install passkeys on multiple, secure devices.

Challenges:

• Device Dependency: Losing all trusted devices makes account recovery complex.
• Adoption Challenges: Service providers must implement passkey support.
• Not Widely Understood: Less tech-savvy users may be resistant to implementation.

Passwords Episode 3: Revenge of Quantum Computing

Quantum computers, though still developing, could break widely used encryption algorithms (e.g., RSA, ECC) in seconds using Shor’s algorithm, which efficiently factors large numbers. This poses a major risk to traditional authentication and public-key cryptography.

In short: Using unbelievably powerful processing, quantum computing can effectively attempt every single combination of options to “crack the code” of any current form of encryption. It’s like successfully predicting the results of the lottery, every single time.

Passwords Episode 4: A Quantum-Resistant New Hope

Passkeys rely on public-key cryptography, and many current cryptographic methods could eventually be vulnerable to quantum attacks. However, researchers are actively working on post-quantum cryptographic (PQC) solutions to mitigate this risk.

How Can Passkeys Be Made Quantum-Resistant?

• Adopting Post-Quantum Cryptography (PQC): Security experts are developing quantum-resistant encryption under initiatives like NIST’s Post-Quantum Cryptography Standardisation.
• Hybrid Cryptographic Models: Combining traditional encryption with quantum-resistant algorithms can provide a gradual transition to full quantum-safe security.
• Biometric and Device-Based Authentication: Since passkeys rely on biometric authentication and hardware security modules, they are less vulnerable to direct quantum attacks.

Final Verdict: Are Passkeys the Solution to Quantum Threats?

In the short-term, yes, they offer stronger protection than traditional passwords and reduce phishing and brute-force attack risks. However, in the long-term only if post-quantum cryptography (PQC) is integrated into passkey authentication methods, will they remain effective.

The good news is, the security of authentication is so vitally important to states and commercial entities that scientists and security experts, far smarter than we are, are working on a solution to the quantum threat.

Top Tips for Protecting Your Account Credentials in 2025.

Passwords are gradually being replaced by more secure authentication methods like passkeys, but full adoption will take time. In the meantime, users should:

• Follow strong password management practices.
• Enable MFA wherever possible.
• Stay informed about authentication advancements.

While passwords won’t disappear overnight, the future of authentication is moving towards a more secure, passwordless landscape.

---

If you would like to upgrade your password infrastructure or general cyber security defences. Speak to one of the team at Trustco today.