have you started using Passkeys for Singpass?

[BMWguy]

It is a crypto private key stored on your phone

what happen when u change/upgrade my iphone?

 

[cosmothecat]

what happen when u change/upgrade my iphone?

Don't know about Android phones, but for iPhones we have a "key ring" on our iCloud where all the passkeys are stored. When we change iPhone, the "key ring" is downloaded onto the new phone with all the passkeys.

I have a spare iPhone (older iPhone 13 pro max) that I am using at home like a mini iPad, the "key ring" is on that phone too and I can log into all passkey related sites. Similarly for all of my iPads and MacBooks.

 

[Jeremy1]

I've not used passkey. Currently, I also use fingerprint scanner without passkey. What's the difference then ?

I used face id more conveniently.

 

[eggie011]

Been using passkey for the last few days to login to CPF app. Totally unreliable.

Sometimes, I need to login twice. At other times, even after login twice, I get thrown back to the login screen. And then login in again works. Donno wth is going on.

Anyone else experiencing the same behavior?

 

[whatheheck]

I've not used passkey. Currently, I also use fingerprint scanner without passkey. What's the difference then ?

i may not be too concise .what I found is this
for the singpass passkey, for boths cases if u tio scammers u will end up authenticating for them unknowingly using your biometrics

"
Shield 1: The Domain Verification (Blocks Fake Websites)

• The Scam Scenario: The scammer creates a fake website that looks exactly like your bank or Singpass //fake-singpass-login.com) and sends you a direct link. You click the link on your phone or laptop.
• How it works: Passkeys are mathematically locked to the real domain name (e.g., singpass.gov.sg).
• The Defense: When you tap "Log in with Passkey" on that fake site, your browser looks at the web address bar. It realizes the domain is fake and refuses to even pop up your Singpass passcode prompt. The scammer cannot steal your login because your phone refuses to talk to a fake website.

Shield 2: The Bluetooth Handshake (Blocks QR-Relay/Screenshot Scams)

• The Scam Scenario: The scammer opens the 100% real, legitimate website on their computer. They take a screenshot of the real QR code and text it to you on WhatsApp.
• How it works: The domain name is completely legitimate in this case, so Shield 1 doesn't apply. Instead, Shield 2 takes over.
• The Defense: Because you are trying to bridge the login from your phone to a laptop, the passkey system demands a local Bluetooth handshake. Since your phone cannot find the scammer's computer nearby, the handshake fails, and the login is blocked .

 

[~sabaisabai~]

I'm using biometric. What's the difference?

 

[mynickname]

I'm using biometric. What's the difference?

Maybe passkey can use from phone to phone like ios?

 

[mynickname]

TL;DR: Biometrics vs Passkey (Why Govt so high-key push?)

• Current Biometric (Face ID / Fingerprint): Just a shortcut to help you tap password/PIN automatically. If you tio phishing website, your face scan still auto-fill for the scammer. Huat ah for scammers.
• Singpass Passkey: Uses public-private encryption key, 100% phishing-proof. Even if scammer build fake Singpass website, the passkey know it’s fake domain and straightaway block, cannot log in one.
• Key difference: No password/OTP sent to server at all. Scammers cannot intercept SMS OTP anymore.

Verdict: Old way = Laziness tool. Passkey = Anti-scam armor. Fast fast go set up, don't wait until CPF money kena drained then cry mother cry father!

 

[euro2012]

no need passkey.. not planning to have one, let kiasu stinkaporeans go try first

i hate people reinvent the wheel always

 

[buttbERry]

got simi issue leh?

 

[sglandscape]

Can't create passkey to be stored in compatible managers like Bitwarden, or on Windows accounts. Or even multiple options simultaneously. As usual gahmen software capability is 2 steps behind.

If passkey lost then just fallback to QR code or password.

Bad design assumption here, so if you already have a password manager the singpass passkey feature is basically useless unless you want to keep toggling between them.

 

[whatheheck]

I'm using biometric. What's the difference?

Post #25

 

[speedsonic]

Changing phone like the easy part mah. Scan qr once again.
Is when those authenticator like authy KO then u wonder what next to do. maybe backups.

 

[jq75]

just recv a Singpass notification today saying I can create passkey now for better protection against phishing

is it like our atm pin??

 

[bruiser69]

beri good the passkey method

 

[tatsit]

yeah i used it immediately when it's available

i'm not sure why banking apps are not using it

 

[jq75]

Passkey for Singpass is a password-free, phishing-resistant login feature introduced by GovTech Singapore. It lets you log in to Singpass-supported digital services using your mobile device's built-in biometrics (Face ID or fingerprint) or device PIN, eliminating the need to type passwords or wait for SMS OTPs.

oh, just ride on device security features

 

[deathan9el]

gotten a prompt from sp but will do it some other time
currently, me have diff sets of pws for diff things alrd

 

[Hello_Kitty]

is it mandatory to change to passkey???

 

[euro2012]

is it mandatory to change to passkey???

no.. not compulsory yet.. thats why i didnt setup yet