Google to Add Passwordless Authentication Support to Android and Chrome

Google today announced plans^[1]
to implement support for passwordless logins in Android and the
Chrome web browser to allow users to seamlessly and securely sign
in across different devices and websites irrespective of the
platform.

“This will simplify sign-ins across devices, websites, and
applications no matter the platform — without the need for a single
password,” Google said^[2].

Apple and Microsoft are also expected to extend the support to
iOS, macOS, and Windows operating systems as well as Safari and
Edge browsers.

The common Fast IDentity Online (FIDO^[3]) sign-in system does
away with passwords entirely in favor of displaying a prompt asking
a user to unlock the phone when signing into a website or an
application.

This is made possible by storing a cryptographically-secured
FIDO credential called a passkey on the phone that’s used to log in
to the online account after unlocking the device.

“Once you’ve done this, you won’t need your phone again and you
can sign-in by just unlocking your computer,” Google said.

“Even if you lose your phone, your passkeys will securely sync
to your new phone from cloud backup, allowing you to pick up right
where your old device left off.”

The new passwordless sign-in capabilities are expected to become
available across Apple, Google, and Microsoft platforms over the
course of the coming year.

“Users will sign in through the same action that they take
multiple times each day to unlock their devices, such as a simple
verification of their fingerprint or face, or a device PIN,” the
FIDO alliance said.

“This new approach protects against phishing and sign-in will be
radically more secure when compared to passwords and legacy
multi-factor technologies such as one-time passcodes sent over
SMS.”

In a way, the method can be viewed as an extension of its own
Google prompts^[4]
for logging into accounts^[5]
secured with two-factor authentication (aka 2-Step
Verification).

The development comes as code hosting platform GitHub announced^[6]
that it will “require all users who contribute code on GitHub.com
to enable one or more forms of two-factor authentication (2FA) by
the end of 2023” to prevent account takeover attacks.