Release Note: New User Verification Option in Security Pro 7.3.4

We have released iThemes Security Pro 7.3.4 today. It provides users with more control over the ways operating systems and browsers may respond to requests for a passkey.

Currently, passkey support is not universal, and it varies across platforms. Some browsers require verification to use a passkey. (For example, a prompt to provide a PIN or biometric verification.) Other browsers do not require this step.

A valid passkey-equipped device or hardware key (like a Yubikey) allows anyone using it to skip through passkey-enabled login forms without entering (or even possessing) a traditional password. The browser or device should ask for an additional verification step like a PIN or a biometric check. (For example, Apple Face ID and Touch ID or Windows Hello.) However, not all browsers currently handle passkey authentication in the same way. Some will not require an additional verification step. In particular, the Mozilla Firefox browser does not support passkeys at all in a MacOS environment.

To protect users against stolen devices and hardware keys, we have added the option to require an additional user verification step or leave it to browsers to decide if this is necessary.

With the 7.3.4, release, if you are using Security Pro’s Passwordless Login and passkey features, you will see the following new option:

As shown above, iThemes Security Pro 7.3.4+ either requires or delegates user verification to browsers when a passkey is used. The default option is to follow each browser’s preferred method for responding to passkey requests.

Security Pro users may update to the 7.3.4 maintenance release at their convenience.