WhatsApp has announced a significant milestone, with over 1 billion users now utilizing passkeys for logging into the app. This achievement marks one of the largest rollouts of passwordless authentication in the consumer technology sector.
WhatsApp’s Major Security Overhaul
In addition to this milestone, the platform, owned by Meta, is enhancing its security framework by upgrading the two-step verification process. The traditional six-digit PIN is being replaced with a robust alphanumeric password system, alongside new caller-context features aimed at reducing scam risks.
Passkeys offer users the convenience of authenticating through their device’s fingerprint sensor, Face ID, or screen lock code, eliminating the need for entering a numeric PIN. This technology, based on cryptographic keys linked directly to the device, provides superior protection against phishing, credential stuffing, and SIM-swap attacks compared to older verification methods.
Expanding Support and Enhancing Two-Step Verification
WhatsApp’s passkey feature is designed to support users who switch between Android and iOS devices, allowing them to register multiple keys under a single account. Users can manage their passkeys through the app’s settings, ensuring seamless access across platforms.
The upgrade to two-step verification introduces a comprehensive password requirement, replacing the simpler six-digit PIN. The new passwords must be at least eight characters long, including letters and numbers, with optional symbols for added security. This change addresses the vulnerabilities of short numeric codes, which are prone to being bypassed by automated or social engineering attacks.
Strengthening Defenses Against Fraud
WhatsApp’s security enhancements are not limited to authentication. The app is also introducing an anti-fraud feature for Android users, providing additional context for incoming calls from unknown numbers. This feature displays information such as the caller’s country and any shared groups, helping users assess the legitimacy of the call.
The initiative is part of WhatsApp’s broader strategy to combat common threats like account takeovers and scams. By integrating passwordless login, stronger password requirements, and contextual call information, WhatsApp aims to bolster its security infrastructure and safeguard user interactions.
Users are encouraged to review their security settings and update to the latest features, ensuring their accounts remain protected against evolving threats.
