How Have We Proven “Who We Are”? Why Passkeys Entered the Picture

These days, many people are working toward a future with passwordless logins.

But that raises an interesting question: why did passwords exist in the first place?

Everything starts with a single question:

“How can I prove that I am who I say I am?”

This question is far more difficult than it may seem. If I asked you right now — how would you prove that you are really you?

In the past, people rarely had to think deeply about this. Important matters were usually handled face to face.

In those situations, there was little need to prove “I am me.”

However, things changed once people began communicating and doing business from a distance.

When you are not physically present, how can you prove to someone else that you are the person who took an action or wrote a document?

Seals and Signatures: The First Remote Authentication Methods

Back when people communicated mainly through letters, this problem was solved with seals and signatures.

By stamping a seal or signing a letter, one could prove, “This letter was written by me.”

However, seals had a critical weakness: they could be forged.

If a seal was forged, someone else could instantly become “you.”

To prevent this, seals became increasingly complex in design.

A famous example is the royal seal, which you may have seen in historical dramas.

In the past, only kings or a small number of important individuals needed to prove their identity.

Today, however, we live in an era where almost everyone must constantly prove who they are.

The decisive turning point was the emergence of the internet.

The Birth of Passwords in the Internet Age

As the internet became widespread, we began doing countless things online:

• Storing personal information
• Conducting financial transactions
• Handling contracts and administrative tasks
• Using all kinds of digital services

Naturally, the question evolved into this:

“How can I prove that I am me on the internet?”

The simplest and most intuitive solution was to verify information that only that person knows. This is what we call a password.

The word “password” literally means a word that lets you pass. When you think about it, it is a surprisingly direct term.

In many ways, passwords became the modern equivalent of a royal seal for the internet age.

The Structural Limitations of Passwords

Over time, the weaknesses of passwords became clear:

• They are difficult to remember
• As a result, people choose simple ones like 1234 or password
• The same password is reused across multiple sites

Such passwords are easy to guess, and once leaked, they allow someone to impersonate the user for a very long time.

In the early days of the internet, this did not feel like a serious problem.

The internet was mainly used for sharing information, and even if an account was hacked, the real-world impact was minimal.

It was an era where people could say,

“You hacked my account? So what can you even do with it?”

That changed completely after the 2000s.

The internet became deeply connected to real life, and a single account takeover could now lead to financial loss and serious social damage.

Increasingly Complex Password Rules

To protect passwords, more and more rules were added:

• Numbers only
• Lowercase letters + numbers
• Lowercase letters + numbers + special characters
• Lowercase letters + numbers + special characters + 12 or more characters

However, the fundamental problem remained. People were no longer managing one password, but dozens of them.

Eventually, it became clear that passwords are structurally destined to be leaked sooner or later.

The First Alternative: OTP (One-Time Password)

To address this issue, OTP (One-Time Password) was introduced.

The idea was simple:

“If a password can only be used once, then even if it leaks, it won’t matter.”

In practice, however, making passwords truly one-time was difficult. This led to the creation of OTP devices.

• The server and the OTP device are synchronized by time
• They generate the same numbers at the same moment
• Only the person holding the device can authenticate

At this point, the core of authentication was no longer the password, but rather whether you possessed the device.

That said, OTP devices had a clear drawback: they could be lost.

Mobile Authentication and SIM Attacks

The next alternative was mobile phone authentication.

Since people carry their phones 24 hours a day, it appeared to be a very secure method.

Over time, however, authentication became overly concentrated on a single device. Some services even allowed users to log in using only their phone.

Attackers quickly realized the true weakness of this structure.

What mattered was not the phone itself, but the SIM card.

Authentication codes are ultimately tied to a phone number — and that number belongs to the SIM.

This led to new types of attacks:

• SIM cloning: copying a victim’s SIM information to create another SIM with the same phone number
• SIM swapping: tricking a carrier or using stolen identification to move a victim’s phone number to the attacker’s SIM

After COVID-19, as non-face-to-face processes became common, even SIM issuance could be done remotely.

As a result, attacks involving stolen IDs increased significantly.

The OAuth Era and Concentrated Account Risk

With the rise of OAuth, users no longer needed to sign up for every individual service.

By logging in with a single account — such as Google — they could access many others.

This convenience, however, gave attackers a clear target.

If they compromised just one major account (Google, Apple etc…), they gained access to everything.

Google accounts, in particular, became extremely valuable.

If a Google account is compromised, all services linked through “Sign in with Google” are placed at risk.

As a result, two-factor authentication is no longer optional — it is essential.

The Emergence of FIDO: Eliminating Passwords Entirely

This growing awareness led to the emergence of FIDO.

FIDO stands for Fast IDentity Online. Its goal is to enable online authentication without relying on passwords.

In 2012, global tech companies such as Google, Apple, and Microsoft formed the FIDO Alliance, marking the official beginning of this effort.

FIDO First Generation: The First Attempt to Replace Passwords

1) FIDO UAF (Universal Authentication Framework)

The idea was simple:

“What if we authenticated users using biometric data such as fingerprints, facial recognition, or iris scans — without passwords?”

• Fully passwordless authentication
• Based on biometric information
• Designed primarily for smartphones

Limitation

• Biometric authentication is difficult in desktop environments

2) FIDO U2F (Universal Second Factor)

To address desktop limitations, another idea emerged:

“What if desktops used passwords plus a second physical device?”

This led to the creation of devices like YubiKey.

• Password + second physical factor
• Example: USB security keys

Limitations

• Poor usability
• Users had to enter a password and then plug in a USB key
• The key had to be carried at all times

As a result, while FIDO’s first generation was technically impressive, it failed to gain widespread adoption due to usability issues.

FIDO Second Generation: A Practical Solution

FIDO’s second generation focused on dramatically improving usability. It is built on two core technologies:

1) WebAuthn (Web Authentication)

• A standard API that allows web browsers to handle authentication directly
• Supported by major browsers such as Chrome, Safari, and Edge

2) CTAP (Client To Authenticator Protocol)

• A protocol that allows devices like smartphones to send authentication data to desktops

Together, these technologies resulted in what we now call Passkeys.

How Do Passkeys Work?

1. A public key and a private key are generated during passkey registration
2. The public key is stored on the server
3. The private key is stored only on the user’s device
4. The server requests authentication
5. The device signs the request using the private key
6. The server verifies it using the public key

This allows users to log in without entering a password.

Apple introduced passkeys in 2022, and since then, “Sign in with Passkey” has been gradually expanding across many services.

Why Passwords Haven’t Completely Disappeared Yet

We are still in a transitional period.

When registering a passkey for the first time, the server has no way to confirm that the received public key truly belongs to the user.

For this reason, a password is still required during the initial setup.

There is also another important reality: If a device is compromised, passkeys are not completely safe either.

After all, the private key is stored on the device itself.

Conclusion: What Matters More Than Passwords

In the era of passkeys, device security becomes even more important than account security.

• Avoid installing apps from untrusted sources
• Do not run unknown programs with antivirus software disabled
• Keep your operating system and browser up to date

Passwords may be disappearing, but our responsibility for security is only growing.