Why use a passkey now?

Passwords, which up until now have been the necessary nuisance of everyone’s cybersecurity experience, are easy to forget and only provide weak protection.  Now you can forget your passwords by using passkeys. Without having to remember anything, you can make your accounts virtually unphishable. 

What is a passkey?

Passkeys, the strongest and easiest multifactor authentication available, are digital credentials that let you sign in to services securely without having to enter a password. You can set up passkeys on your phone, computer, or a security key.  You approve your sign-in with a passkey the same way you unlock your device –  a fingerprint,  face scan, or a pin (first factor), and then your unique passkey (second factor) is recognized by your service provider and you are in. Your passkeys can be stored in a credential manager of your choice (for example: Google Password Manager, Apple Passwords, or 1Password) so they are accessible across all of your devices – even new ones.

You need a passkey now

Cybersecurity professionals consider people who work in politics and government to be high-risk users. The Forget Passwords. Use a Passkey. campaign is being launched in conjunction with Cybersecurity Awareness Month this October. The timing and theme couldn’t be better aligned in an election year. This month’s theme, Securing Our World, is exactly what we need to do in the political sector and extend security beyond the campaign perimeter.

Bad actors like nation states, cybercriminals, and hacktivists, know they can have the biggest impact the closer they plan their attacks to Election Day. Anyone in or around a campaign are prime targets for bad actors.

You are a target and high-risk computer user if you:

• Work or volunteer for a campaign

• Work for a vendor that serves campaigns, such as a digital, data, or polling firm

• Are or work for an elected official

• Work for an advocacy organization, a PAC, or a nonprofit engaged in the election process

• Are you a family member, friend, or associate of a candidate

How do I start using a passkey?

The Forget Passwords. Use a Passkey. campaign urges you to secure your world by adopting a passkey for at least one account in October.  A good place to start is with your highest value accounts.

Passkeys are being activated in more services every day. Click on the links below to find details about how to enable passkeys on these commonly used platforms.

Join the #ForgetPasswords campaign!

If you are an organization working with or alongside a campaign join our efforts to help share the importance of passkeys. Contact  info@defendcampaigns.org with the subject line: Forget Passwords 

Once you've enabled a passkey on an account, post this on your favorite social media site:

Oops, I forgot my password! Not a problem. I joined the #ForgetPasswords use a passkey campaign from @defendcampaigns for #cybersecurityawarenessmonth defendcampaigns.org/passkeys

What’s the #ForgetPasswords. Use a Passkey Campaign about?

The #ForgetPasswords Campaign is a collaborative effort in the last and riskiest cybersecurity days of the campaign to get high-risk technology users in the political sector to adopt Passkeys, the strongest multifactor authentication possible. Billions of phishing scams are sent every day focused on stealing login credentials through various channels including email, social media, text messages, and more. Bad actors try to penetrate campaigns by compromising the accounts of people connected to or around campaigns. DDC is encouraging everyone in and around the campaign space to adopt a passkey for at least one core account such as their personal email, cloud or social media.

The campaign is an effort by DDC and its partners during Cybersecurity Awareness Month.  Working with our technology partners and others concerned about protecting campaigns and people, the effort is aimed at a broad swath of the political sector including campaigns, political vendors, advocacy groups, and anyone active in politics to prioritize better cybersecurity. 

Our goal is to increase the resistance of campaigns and political sectors to cyber attacks by getting individuals to go beyond using passwords and enable a simpler, stronger, and now readily available form of multi-factor authentication, Passkeys. 

Every high-risk individual that protects their accounts, by extension, protects candidates, campaigns, and other campaigns and organizations they care about and support.

The Data Behind the Campaign

There is a lot of data that supports the need for increased adoption of the strongest forms of multifactor authentication by high-risk users in the political sector.

In a recent Yubico study respondents report the most commonly compromised passwords are on the apps and services that hold their most confidential, financial, and personal information. These include:

• Social media account - 44%

• Payment app - 24%

• Messaging app - 17%

Respondents also reported that with the rapid advancements of artificial intelligence,  online scams and phishing attacks have become more sophisticated (72%) and successful (66%). 

Unfortunately,  respondents show a lack of awareness of best practices for authentication and have a misunderstanding of what keeps accounts secure::

• Thirty-nine percent think username and password are the most secure

• Thirty-seven percent think mobile SMS-based authentication is the most secure,

Neither of these authentication methods is sufficient for high-risk users in the political sector

People in the political sector know they are targets. Respondents in a 2022 Google survey of people in the political sector found that:

• Eighty-two percent of respondents reported digital accounts were hacked or accessed

• Eighty-three percent believed the threat of cyber attacks on them has increased in the last two years

• Fifty-nine percent believed their professions make them more likely to be a target of hacking or phishing

• Seventy-three percent believed the risk is a result of increasingly sophisticated hacking/phishing techniques