Lion Cipher Lab
Set up a passkey and see why it resists phishing
- Identity & Access Management
- Beginner
- ~30 min
- Free · no account required
Why it matters
Passwords are the credential attackers steal most, and even good second factors have a soft spot: a code you type into a page can be typed into the wrong page. A convincing fake login site can capture your password and, if you are using text-message or app-based codes, relay that one-time code to the real site within its 30-second window and walk straight in. Passkeys were designed to remove that soft spot entirely. A passkey is a public/private key pair created for one specific site; the private half never leaves your device, and the login is cryptographically tied to the real site's web…
What you'll learn
- what a passkey is
- public/private key pairs
- WebAuthn and FIDO2
- origin binding
- why passkeys resist phishing
- enrolling a passkey
- how passkeys compare to passwords and TOTP
Steps in this lab
- What a passkey actually is
- The private key never leaves your device
- Why phishing beats passwords, and can even beat TOTP
- The origin check: why a passkey refuses to sign in to a fake site
- Now do it for real: enrol a passkey on your own account
- What just happened under the hood
- Passkey vs password vs TOTP, side by side
- The habit to carry forward