2023-now
📝
Led exploratory research with another designer to validate design hypotheses
📍
Landed on required product strategy decisions for further discussion
From 2023 to 2025, the Singpass division went through 3 different directors with different aspirations towards new form factors. Passkey was always on the radar of management and I worked on it over the past 3 years.
Before we begin, what are passkeys?
Introduction
Passkeys are a safer, passwordless way to log in. They use public-key cryptography, where a private key is stored securely on your device and is tied to a specific website.
This means passkeys only work with the real Singpass site — not lookalike phishing sites. Compared to current Singpass login methods, passkeys offer much stronger protection against phishing.
Types of passkeys
Executive summary
Context
In 2024, there were 600 phishing cases through Singpass login to other government services. To eliminate phishing in Singpass logins, implementing phishing resistant passkeys as a form factor increases baseline security of Singpass logins as a whole.
Impact
Pivoted passkey messaging strategy - User research showed people prioritize convenience over security when choosing login methods. Shifted from security-focused messaging to emphasizing both convenience and security for better adoption.
Identified login screen strategy gap - Highlighted urgent need for clear login screen strategy moving forward.
Product strategy
Roll out software passkeys first due to lower cost & complexity and it’s able to increase baseline security for more users.
Roll out hardware passkeys later as it involves higher complexity in handling different token brands.
Technical considerations
What are authenticators?
The team was deciding whether to store private keys using built-in authenticators (apps that securely store and manage your login credentials) like iCloud Keychain and Google Password Manager that come with your device, or to create a custom Singpass-built authenticator.
For custom built authenticators, the designers referenced how the interaction would be by looking at 1Password authenticator.
We noticed a higher learning curve using a custom authenticator where users are required to download 1Password as a mobile and web app, and turn on saving passkeys to 1Password on the device’s settings.
Technical decision
As such, we eventually landed on building native authenticator for our initial design explorations as
It takes lesser engineering effort for a proof of concept
It will also be more predictable for users who use passkeys on other apps
Initial survey
As part of our exploratory research, we did a survey with ~600 participants using GovTech recruitment platforms — Tech Kaki and Crowdtask.
Survey objectives
Identify gaps in users’ understanding of the current authentication methods
Inform us on the narrative of how different auth factors protect users from different threats
Key findings
88% of participants log in with QR today. And when asked why they prefer this login method, most participants chose QR as the easiest and faster method, but security is least of their focus.
When asked about what does logging in with 2FA means in Singpass, only 11% cited that Singpass app is a 2FA method. Yet 88% of participants log in with Singpass app today. This suggests that there seems to be a gap in the understanding of 2FA and it could be an opportunity for user education when we launch passkeys.
How this guides us
Convenience drives adoption, not security
Users choose QR login for ease and speed—security isn't their priority. Security-focused messaging risks poor adoption.
Designing key flows (1st iteration)
Selected screens shown due to limited space
Design constraint
We wanted to explore how this new login method impacts the overall login ecosystem and whether creating passkeys require other methods for authentication. These will mean there should be other flows when passkeys is introduced as a new form factor.
But due to limited engineering resources, we had to make assumptions and focus mainly on the key flows for explorations.
Key passkey flows
Design crit with stakeholders and design team
We chose to print out our designs — so that participants can focus on the content and messaging, instead of the interactions — as that might change after deeper engineering explorations.
Guerrilla testing (2nd iteration)
After iterating the designs based on the feedback from design crit, we brought our updated designs for a Guerrilla testing around GovTech office. We spoke to 12 participants, of which only 2 software engineers have logged into other apps with passkeys.
Research objectives
Gather feedback on comprehension/understanding of our passkeys designs → to inform content and illustrations decisions
Understand sentiments when we add additional consent on Singpass app to creation and login flows
Key findings
Users' mental models didn't align with passkey login — they kept scanning the Singpass QR instead of clicking the password field to access their saved passkey.
HMW design a login page that aligns with users’ mental models, encouraging them to use passkeys to log in instead of their default QR code scanning behaviour?
Participants don’t understand what are passkeys as they are unfamiliar with cryptographic key pairs and password manager. Terminologies doesn’t help to form a mental model of how it works (e.g. cryptographic key pair, password manager)
HMW design a landing page about passkeys that speaks to both experts and first-time users without overwhelming or oversimplifying?
After completing the guerrilla tests, there was a shift in management priorities and a reorganisation of the division. As such, we took a 6 month break and did not act on the key problem statements above.
Where are we now?
The division created a new team to look into new form factors and of course dive deeper into passkeys. I will share more in a private setting! Hit me up for a chat.