techlist.io
KREN
gitlab

Passkeys now available for passwordless sign-in and 2FA on GitLab (opens in new tab)

gitlabdevsecopssecuritymulti-factor-authenticationpasskeystwo-factor-authenticationwebauthnpublic-key-cryptography

GitLab now supports passkeys for passwordless sign-in and phishing-resistant two-factor authentication. Built on WebAuthn and public-key cryptography, passkeys let users authenticate with a fingerprint, face recognition, or device PIN while keeping the private key on their device. Users can register multiple passkeys across browsers, mobile devices, and FIDO2 security keys, improving both security and convenience.

Passkeys for Sign-In and 2FA

  • Passkeys can be used:
    • As a passwordless login method.
    • As a phishing-resistant 2FA method.
  • For accounts with 2FA enabled, passkeys automatically become the default 2FA option.
  • Authentication uses a device fingerprint, facial recognition, or PIN.

Registration and Compatibility

  • Users can register passkeys under Profile settings > Account > Manage authentication.
  • Supported platforms include:
    • Chrome, Firefox, Safari, and Edge.
    • iOS 16 and later.
    • Android 9 and later.
    • FIDO2 hardware security keys.
  • Multiple passkeys can be registered for access across different devices.

WebAuthn Security Model

  • Passkeys rely on WebAuthn and public-key cryptography.
  • The private key remains securely stored on the user’s device and is never sent to GitLab.
  • GitLab stores only the public key.
  • A breach of GitLab’s stored credentials would not give attackers usable private keys for account access.

GitLab’s Security Goals

  • Passkeys support GitLab’s commitment under the CISA Secure by Design Pledge.
  • They help increase MFA adoption while providing a smoother, phishing-resistant authentication experience.
  • GitLab invites users to provide feedback through its community and feedback channels.

Users should register passkeys in their GitLab authentication settings, ideally across multiple trusted devices or security keys for both stronger protection and account recovery.