Why fepli recommends passkeys
The admin panel holds names, dates of birth and consents of participants and their families. fepli therefore recommends signing in with a passkey. Until you have set one up, the sign-in link by email is enough; you do not need a password.
What makes passwords vulnerable
A password is a secret that you know and type in at every sign-in. Attacks target exactly that. A forged sign-in page asks for it, or a data leak at another service gives it away if you use it there too.
On top of that comes what people do with passwords. They choose short or obvious passwords, write them down or forget them. Every reset costs time, for you and for the team.
How a passkey works
A passkey is a key pair. The secret key stays on your device; fepli stores only the public one. At sign-in, the device and fepli check the two keys against each other. Only you can release this, by fingerprint, face or device PIN.
Because the secret key never leaves your device, no forged page can ask for it. A data leak at fepli would reveal only public keys, with which nobody can sign in. Each passkey applies to exactly one account. It can neither be too short nor be forgotten.
What the BSI recommends
The German Federal Office for Information Security (BSI) recommends passkeys as a secure and at the same time convenient way of signing in. In the BSI's assessment, they replace the password with trustworthy services. The reasons are given on the page Passkeys – anmelden ohne Passwort and in the press release Login-Verfahren: BSI empfiehlt die Nutzung von Passkeys of 01.10.2024, both in German.
What the sign-in link by email is for
The sign-in link is the interim solution for everyone who does not have a passkey yet. fepli sends it to your email address; it is valid for 10 minutes and only once. There is no password that someone could intercept or guess.
However, the link is only as secure as your email mailbox. Also, every sign-in costs the detour via email. A passkey saves both.
Why admins get no sign-in link
Admins have far-reaching rights, often also to the data of all families of an instance. fepli therefore does not let them in by sign-in link by default. An admin who requests a link receives the email “Sign-in link not available” with the routes that remain: passkey or password. Anyone with neither is referred to a super admin. Whether admins may use the link after all is decided by the operator of the installation.
After anyone requests a link, the sign-in page states this rule, whichever address they entered. Admins then know why no link comes. The page does not reveal whether an address belongs to an admin.
The block also applies when a link is redeemed. A sign-in link does not reveal which page it was requested on, and a link from the website or from a registration should not open an admin account. The admin panel therefore refuses sign-in links for admin accounts that have signed in before. Anyone who has never signed in follows their invitation and still gets in.
New admins get in once with the link from their invitation. It is valid for several days, because nobody opens an invitation in the first minutes, but only once. How many days is set by the setting Invitations valid for. After that, new admins sign in with a passkey.
How invitations work without a password
Anyone who registers as an organizer through an invitation or follows an invitation to a club's team chooses between passkey and password under How you sign in. The passkey is preselected. The account then gets no password, and the person sets up the passkey right in the next step. Because the link from the invitation has already confirmed the email address, they are signed in immediately.
The password with at least 8 characters stays for devices that do not support passkeys. Anyone who registers without an invitation sets no password at all and receives a sign-in link after being activated.
When the device with the passkey is missing
A passkey is stored on a device or in the account with which your devices synchronise passkeys, e.g. at Apple or Google. If you set up two passkeys, for example on a laptop and a smartphone, you can get in even without one of the devices.
Organizers otherwise sign in by sign-in link and set up a new passkey. For admins without a sign-in link, only the password is left, if their account has one. A second passkey is therefore worthwhile for them.
Nobody on the team sets a new password. The team sends a link to the account's address with Send password link, and the person sets the password themselves. In this way nobody on the team knows the password, and anyone who poses as someone else on the phone does not receive the link.