Two of Germany’s largest consumer email providers, GMX and Web.de, have enabled passkey logins, letting users in Germany, Austria, and Switzerland sign in to their inboxes with a fingerprint, face scan, or device PIN instead of a password.
A passkey is a cryptographic credential that replaces the password at sign-in. It comes in two parts: a public key held by the service and a private key that stays on the user’s device, such as a smartphone, and only the two together unlock the account. Because the private key never leaves the device and the credential is bound to the provider’s genuine website, a passkey simply fails on the fake login pages that fraudsters use in phishing attacks, which is the main security gain the two providers are promoting.
The feature is free and can be switched on in the account settings under login and security, the companies said on their help pages. After activation, signing in requires only the email address followed by a confirmation on the device. Users keep their existing password as a fallback, for instance when a phone is not to hand, and a passkey saved to the cloud can be restored on a new device; if a device is lost or stolen, users can delete and re-create their passkeys from the account settings.
Rolling passkeys out to a mainstream consumer email base matters because webmail accounts are a high-value target, sitting at the center of password resets for banking, shopping, and social accounts. Moving even a fraction of that base off passwords removes the reusable secret that phishing and credential-stuffing attacks depend on, and it normalizes device-bound biometrics for users who may never have used a passkey on any other service.
The move puts two large European consumer brands alongside the enterprise and platform players driving the same shift, from Microsoft’s mandatory passkey timeline for Entra ID to Google’s addition of FIDO2 security keys to Windows login. Consumer webmail is a different battlefield, reaching tens of millions of everyday users who never encounter an enterprise security policy.
Whether those users switch is the test, since passkeys only blunt phishing at scale if enough people adopt them, and keeping the old password as a fallback leaves the weaker path open for anyone who declines.
Sources: t-online
–
By Ali Nassar-Smith
