Passkeys

A passkey is a sign-in credential kept by your device or your password manager. You unlock it with your fingerprint, your face or your screen lock. In Vumasign, a passkey is one way to complete two-step verification. The authenticator app is the other. This page is about the people who sign in to Vumasign: you and your colleagues. Signers never need a passkey. To check who a signer is, see signer verification.

​

What a passkey replaces, and what it does not

Signing in to Vumasign has two steps:

1. Who you are. You use your password, Google, or your organisation’s identity provider.
2. That it is really you. If you have turned on two-step verification, you then prove it.

A passkey is for the second step. You can use it instead of a code from an authenticator app. A passkey does not replace the first step. You still sign in with your password, Google or single sign-on first. Signing in with only a passkey, with no password, is not available. You can have passkeys, the authenticator app, or both. When you have both, the second step lets you choose. A recovery code works at the second step as well.

​

Why use one

• A look-alike site cannot use it. Your browser offers a passkey only to the site it was made for. A page pretending to be Vumasign at another address cannot ask for it.
• Vumasign checks where it was used. Vumasign accepts a passkey only when your browser reports that it was used on the Vumasign app itself. A passkey used on any other page, even one on a Vumasign address, is refused.
• There is nothing to type. A code from an authenticator app can be read over your shoulder, or typed into the wrong page. A passkey never leaves your device or password manager.
• Vumasign holds no secret for it. Vumasign keeps only the passkey’s public half, which can check a sign-in but cannot make one.

Each time you use a passkey, it asks you to unlock it with your fingerprint, face, PIN or screen lock. Vumasign refuses a passkey that was used without that check.

​

Adding a passkey

​

When Vumasign offers one

Right after you sign in, Vumasign may ask whether you would like to add a passkey for this device. It asks only when all of these are true:

• Passkeys are available on Vumasign at the time.
• You signed in with a password or Google. Signing in through your organisation’s identity provider does not bring the offer.
• You did not sign in through break-glass.
• You have just signed in. The offer is shown only in the first minutes of a session.
• The organisation you signed in to does not require single sign-on.
• You have no passkey yet.
• You have not turned the offer down before.

It also asks only if your device has a built-in way to unlock a passkey, such as Touch ID, Face ID, Windows Hello or a phone’s screen lock. If you say no, or close the question, Vumasign does not ask again. You can still add a passkey whenever you like in Settings.

​

From Settings

Go to Settings, then Sign-in security. Under Passkeys, give the new passkey a name (such as “Work laptop”) and choose Add a passkey. Your browser or device then asks you to create it. You can have up to 10 passkeys. If you use several devices, add a passkey on each, or use a passkey that your password manager keeps in step across your devices. The list shows which kind each passkey is: Synced across your devices or On one device.

​

Proving it is you first

Adding or removing a passkey changes how your account is protected, so Vumasign checks it is you.

• If you signed in within the last 10 minutes, that sign-in is enough.
• If not, you are asked to confirm with one of your passkeys, a code from your authenticator app, or a recovery code.
• If you have no two-step verification yet, and you signed in longer ago, sign out, sign back in, and add the passkey straight away.

This means somebody who finds your computer unlocked cannot quietly add a passkey of their own.

​

Recovery codes

If you add a passkey when you have no two-step verification yet, it comes with 10 recovery codes. They are shown once. Save them somewhere safe, away from the device. If the authenticator app is already on, you keep the codes you got with it. A recovery code gets you past the second step when you cannot use your passkey, for example after you lose your phone. Each code works once. To get new codes, go to Settings, then Sign-in security, and choose Replace recovery codes. You prove it is you first, as above. You get 10 new codes, and the old ones stop working at once. Your codes stay valid for as long as you have any form of two-step verification. If you turn the authenticator app off but still have a passkey, they keep working. When you remove your last passkey and the authenticator app is off, the codes are deleted. You have no second step left for them to stand in for.

​

If you lose a device

1. Sign in with your password or Google as usual.
2. At the second step, use another passkey, your authenticator app, or a recovery code.
3. Go to Settings, then Sign-in security, and remove the passkey for the lost device. Add a passkey on your new device.

If your lost passkey was synced by a password manager, it may still be on your other devices. Remove it only if you think somebody else might now have access to it.

​

What you and your organisation are told

• You get an email each time a passkey is added to or removed from your account, and each time your recovery codes are replaced. If it was not you, the email says what to do. These emails have no links in them, so a fake one is easier to spot.
• Each organisation you belong to records it. Adding or removing a passkey is recorded in every organisation you belong to, since your sign-in protects your access to all of them. The record says only that a passkey was added or removed, and whether it is synced. Owners and admins see it in Recent activity, under Settings, Single sign-on.

​

How many tries

You can use a passkey 10 times in each quarter-hour of the clock (:00, :15, :30, :45). Every try counts, including the ones that work. Passwords and Google, and each identity provider, have separate counts. Passkey tries do not use up the 5 codes you can enter in the same time. If you run out of passkey tries, you can still use the authenticator app or a recovery code.

​

Single sign-on and break-glass

If you sign in through your organisation’s identity provider and you have two-step verification, you are asked for it as well. A passkey works there just as it does after a password. Vumasign does not offer to add a passkey after a single sign-on sign-in. Add one in Settings instead. If your organisation requires single sign-on, its owners can still get in when the identity provider is down, through break-glass. To do this, an owner needs two-step verification. A passkey counts, and so does the authenticator app. Every owner is emailed each time break-glass is used, and the email says which one the owner used. So that your organisation can always get back in, the last owner who could break glass cannot remove a passkey that is their only two-step verification while single sign-on is required. To remove it, they must first add another passkey or turn on the authenticator app.