Beyond Passwords: A Simpler Way to Sign In

Imagine opening a shopping website and being asked to invent another password. You try something memorable, add a number, and then discover that the site also requires a special symbol. Months later, you cannot remember what you chose. This hypothetical scene captures a familiar design problem: an account must be protected, but its owner also needs convenient access. Passkeys offer a different approach, allowing people to approve a sign-in through a device rather than recall another secret.

想象一下，你打开一个购物网站，又被要求创建一个密码。你尝试了一个容易记住的密码，加上一个数字，随后却发现网站还要求加入特殊符号。几个月后，你已经记不起当时选了什么。这个假设场景体现了一个常见的设计问题：账户必须受到保护，但账户主人也需要方便地访问它。通行密钥提供了一种不同的方法，让人们通过设备批准登录，而不必再记住一个秘密。

The US National Institute of Standards and Technology, or NIST, explains why improving a password does not solve every problem. A convincing fake website can persuade someone to hand over even a long, complicated password. This is phishing: the attacker imitates a trusted service and collects information from visitors. Password reuse creates another weakness. If one account is compromised, the same password may put other accounts at risk. These problems involve how secrets are handled, not simply how difficult they are to guess.

美国国家标准与技术研究院，简称NIST，解释了为什么改进密码并不能解决所有问题。一个足以乱真的假网站，可能说服用户交出密码，即使密码很长、很复杂。这就是网络钓鱼：攻击者模仿可信服务，收集访问者的信息。重复使用密码还会造成另一种弱点。如果一个账户遭到入侵，相同的密码可能使其他账户也面临风险。这些问题涉及如何处理秘密，而不仅仅是秘密有多难猜。

A passkey changes the interaction. NIST describes a private digital key stored on a device, such as a phone. The user can approve access with a PIN or facial recognition, much as they unlock that device. FIDO Alliance, the industry organization behind the relevant authentication standards, explains that passkeys rely on cryptographic security. Instead of choosing and typing a reusable secret, the user lets the technology establish that they have the appropriate credential. The technical process becomes less visible, while the familiar action of unlocking remains.

通行密钥改变了交互方式。NIST描述了一种存储在手机等设备上的私有数字密钥。用户可以通过PIN码或面部识别批准访问，就像解锁设备一样。相关身份验证标准背后的行业组织FIDO联盟解释说，通行密钥依靠密码学安全机制。用户不再选择并输入一个可以重复使用的秘密，而是让技术确认自己拥有适当的凭证。技术过程变得不那么显眼，而熟悉的解锁动作仍然保留。

This also changes the opportunity for phishing. A password is something a person can type into the wrong place. A passkey is associated with the particular service for which it was created, and the system checks where it is being used. Apple's 2022 developer demonstration shows this protection alongside familiar sign-in interfaces. The practical interpretation is that security depends less on a person spotting every convincing imitation. However, protection against credential phishing should not be interpreted as a promise that every device, account, or online activity is completely safe.

这也改变了网络钓鱼可以利用的机会。密码是人可以输入到错误位置的东西。通行密钥与创建它时对应的特定服务相关联，系统会检查它被用在什么地方。苹果在2022年的开发者演示中，将这种保护与熟悉的登录界面一起展示出来。从实际意义上解读，安全性因此较少依赖用户识破每一个足以乱真的仿冒页面。不过，防止凭证钓鱼的保护，不应被理解为对所有设备、账户或网络活动完全安全的承诺。

Convenience is central to the idea. In its May 2023 announcement, Google described passkeys as a way to sign in using a fingerprint, face scan, or screen lock PIN. It introduced them as an additional option alongside existing methods. FIDO's November 2024 explainer also describes synchronization across devices. These dated materials illustrate the direction of the technology; they do not establish today's availability on every service. A useful question for an individual user is therefore whether their particular account and devices support the experience they need.

便利性是这一理念的核心。在2023年5月的公告中，Google将通行密钥描述为一种通过指纹、面部扫描或屏幕锁定PIN码登录的方式。它将通行密钥作为现有方法之外的额外选项推出。FIDO在2024年11月的说明中也描述了跨设备同步。这些有明确日期的材料说明了技术发展的方向；它们并不能证明今天每项服务都已支持这种方式。因此，对个人用户而言，一个有用的问题是：自己的具体账户和设备，是否支持自己所需要的使用体验。

Consider a hypothetical student who mainly uses a phone but occasionally works on a borrowed laptop. A faster sign-in on the phone would be helpful, yet the student would also want to understand access from another device. Apple's demonstration shows a cross-platform process in which a phone helps authorize a login on a computer. Still, a demonstration cannot answer every personal situation. Before depending on a new method, the student could check the service's instructions for changing devices and recovering access. Those questions are part of usability, not an objection to innovation.

考虑一个假设中的学生：他主要使用手机，但偶尔也会在借来的笔记本电脑上工作。在手机上更快地登录固然有帮助，但他也会想了解如何从另一台设备访问账户。苹果的演示展示了一种跨平台流程，由手机帮助批准电脑上的登录。不过，一次演示无法回答每个人的所有具体情况。在依赖新方法之前，这名学生可以查看服务方关于更换设备和恢复访问权限的说明。这些问题属于易用性的一部分，并不是对创新的反对。

Passwords remain useful partly because they work across a wide range of machines. NIST emphasizes this versatility when explaining why their disappearance will take time. Where passwords are required, it recommends a password manager and additional authentication protection. Google likewise acknowledged in 2023 that a transition would take time and retained existing sign-in options. The broader lesson is that replacing a familiar technology requires more than a better mechanism. People need understandable choices, suitable devices, and confidence that they can still reach their accounts when circumstances change.

密码仍然有用，部分原因在于它能在各种机器上使用。NIST在解释密码为何需要时间才会消失时，强调了这种通用性。在必须使用密码的情况下，它建议使用密码管理器，并增加身份验证保护。Google同样在2023年承认转变需要时间，并保留了现有登录选项。更广泛的启示是，替换一种熟悉的技术，需要的不只是更好的机制。人们需要容易理解的选择、合适的设备，以及在情况变化时仍然能访问账户的信心。

Passkeys therefore invite us to rethink what convenient security looks like. In this reading's interpretation, a well-designed system should reduce the number of difficult decisions demanded during an ordinary task. Imagine explaining the change to a relative: instead of starting with technical vocabulary, you might describe the sign-in action, demonstrate it, and discuss what happens if the phone is unavailable. The goal is informed confidence. A simpler login becomes valuable when people understand both the everyday benefit and the arrangements that keep access dependable.

因此，通行密钥让我们重新思考，方便的安全措施应该是什么样的。按照本文的解读，一个设计良好的系统，应当减少人们在日常任务中需要作出的困难决定。想象一下，你要向一位亲戚解释这一变化：你可以先描述登录动作，进行演示，再讨论手机无法使用时会发生什么，而不是从技术词汇开始。目标是建立有理解为基础的信心。当人们既明白日常使用的好处，也了解确保访问可靠的安排时，更简单的登录才会变得有价值。