Bibkins-neon begins passkey rollout
Bibkins-neon is introducing passkeys in stages. Eligible players will be able to sign in with a credential protected by their phone or computer, without entering a password. Because the credential is tied to the site, it also reduces the risk of stolen passwords and fake login pages.
Setting up a passkey
The first invitations will appear on supported phones, computers, operating systems and browsers, with availability expanding by region and account eligibility. A player who receives the option can create a passkey after signing in through the existing account flow and completing any required security checks. Before confirmation, the setup screen shows which device or credential provider will hold the passkey. Password sign-in remains available where passkeys are not yet supported during the staged rollout.
A passkey uses public-key cryptography. bibkins-neon.store receives a public key, while the corresponding private key stays protected by the player's device or chosen credential provider. Face recognition, a fingerprint or a device PIN may unlock that credential locally; biometric data is not sent to bibkins-neon.store. Some operating-system ecosystems can securely synchronize passkeys across a player's approved devices, while others keep them on a single device, so the setup experience may differ.
Protection against phishing
Each passkey is created for bibkins-neon.store and will not authenticate a look-alike domain. That origin binding means a convincing copy of the sign-in page cannot collect a password that an attacker can replay elsewhere. It also removes the shared secret targeted by credential-stuffing campaigns after another service is breached. Passkeys therefore reduce two familiar account-takeover paths, although they do not make a compromised device, unsafe email account or manipulated support conversation harmless.
For returning players, the normal action is a short device approval instead of typing a password and one-time code. Existing risk controls still apply: unusual devices, locations or account activity can still trigger an additional check or a temporary review. Active sessions can be managed from account settings, and players should remove devices they no longer control. Those checks also protect withdrawals, profile changes and other sensitive actions.
Recovering access
Players should keep their verified email, phone and trusted devices current before replacing a handset or computer. They can also register more than one compatible device, reducing the chance that a single loss becomes a recovery event. If every passkey is unavailable, a trusted-device route and an account review remain available; support may ask for information needed to establish ownership and will not request a passkey, password or one-time code. During the rollout, we will review setup and sign-in success rates alongside recovery requests and security reports. That feedback will inform the guidance before passkeys become the default for more accounts.
