Cybersecurity Month

Passkey Awareness Quiz · Oct 2026

Part 1 — Why Passwords Let Us Down
Q1. Reusing the same password across multiple websites is safe, as long as the password is long and complex.
💡 Hint: Length and complexity don't help if one site is breached — attackers take that leaked password and try it everywhere else (credential stuffing).
✓ Correct!
Q2. A password only protects you if it stays secret — the moment someone else learns it, they can log in as you from anywhere in the world.
💡 Hint: Passwords are a "shared secret." Anyone who obtains them can type them in—no physical device required.
✓ Correct!
Q3. Phishing works by tricking you into typing your real password into a fake website that looks just like the real one.
💡 Hint: The fake site captures whatever you type and relays it directly to the attacker.
✓ Correct!
Q4. If you turn on a one-time SMS code (a text-message code) on top of your password, phishing can no longer steal your login.
💡 Hint: A fake site can ask for the SMS code too and relay it in real-time before it expires. SMS codes are still phishable.
✓ Correct!
Part 2 — How Passkeys Change the Game
Q5. A passkey is essentially just a longer, stronger password stored in your browser.
💡 Hint: A passkey isn't a secret you type. It's a pair of cryptographic keys (public key on server, private key on device).
✓ Correct!
Q6. With a passkey, the private key that proves your identity never leaves your device — not even when you sign in.
💡 Hint: Your device signs a unique challenge and sends back only the signature. The key itself never travels across the internet.
✓ Correct!
Q7. To use a passkey, you typically confirm with something on your own device — like a fingerprint, face scan, or device PIN.
💡 Hint: Biometrics unlock the passkey locally on your device and are never sent to the website.
✓ Correct!
Q8. A passkey is tied to the exact website it was created for, and your device will refuse to use it on a look-alike phishing site.
💡 Hint: Passkeys are domain-bound. On a fake domain, the browser simply won't offer the passkey.
✓ Correct!
Part 3 — Putting It Together
Q9. Because there's no secret to type, a passkey can't be phished, leaked in a website breach, or reused across sites.
💡 Hint: Even if a website is hacked, attackers only get public keys, which are useless on their own.
✓ Correct!
Q10. Switching to passkeys means you have to memorize an even more complicated secret than before.
💡 Hint: There is nothing to memorize at all! Passkeys replace passwords with quick biometric checks.
✓ Correct!