you can now sign in to your google using passwords. Google has added the capability in what is arguably the biggest step in encouraging the use of authentication technology designed to address many of the weaknesses of passwords.
Access keys – developed by Apple, Microsoft, Google. and other allies – use a strong cryptographic security framework that ties your login rights to your phone or computer. There are no obscure strings of letters, numbers, and punctuation to remember. Access keys typically use a biometric authentication step such as a fingerprint or facial recognition, although other options are possible.
Google has already built support for passkeys into its Android phone software and the Chrome web browser, but it wasn’t until Wednesday, the eve of World Password Day, that you could use passkeys to sign into Google websites. For now, access keys work alongside other login methods, so you can try them without giving up other previous authentication methods like passwords or hardware security keys.
If the access keys work as expected, they will be secure and easy enough to use to completely destroy passwords. Considering how many millions of us use Gmail, YouTube and Workspace, password support in Google services is a big deal for this technology.
“Password keys are the beginning of the end for passwords,” said Christian Brand and Sriram Karra, two Google executives who oversaw the project. says the blog post Wednesday
in my access key tests, I was able to easily generate a passkey on my primary Android phone and propagate those credentials to my Mac and then to my iPhone. My existing authentication options—hardware security keys, app authentication, and Google app prompts—are still available.
Passwords are familiar but not easy to use. We choose guessable passwords that hackers can crack. We reuse passwords across multiple apps and services, so stolen credentials can be used in “credential stuffing” attacks to compromise other accounts. We support passwords with two-factor authentication, but it has its own issues, especially with login codes sent in a text message.
Access codes are designed to bypass all of this. They are based on cryptographic standards that secure e-commerce transactions and network communications. Fast Identity Online Alliance for use in authentication. The FIDO Alliance started with hardware security keys, the strongest core authentication technology, but repackaged it into access keys in an attempt to make it easier and cheaper to use.
While passwords are new, some sites have surpassed Google in login support. Among companies offering login password are eBay, Docusign, PayPal and Shopify.
As with hardware security keys, login credentials are configured to work with an application or website service. Your phone or computer does the actual authentication locally on its own hardware. This prevents one of the biggest security threats today, phishing attempts that try to get you to share your credentials or other sensitive information with fake websites.
You can set up passwords on multiple devices. And if you’re temporarily logging in using your friend’s phone or a public library computer, Google offers a QR code scanning mechanism that allows you to temporarily log in without permanently storing your password.
Password managers use passwords
One of the complexities of access keys is that they are, at least for the moment, tied to specific technology ecosystems – mainly Apple and Google. For example, when you install a Google passkey on an Android phone, Google automatically generates passkeys on other Android devices, but not on your iPhone.
But password manager makers Bitwarden, LastPass, Dashlane, and 1Password are now active in the FIDO Alliance and are working on technology that allows you to export and import passwords. However, it’s not clear how easy the process will be, and while Google has expressed support for the idea, Apple has remained silent.
“Today, with Google enabling passwords, 1.5 billion people worldwide now have the ability to use passwords,” 1Password CEO Jeff Shiner said Wednesday. “However, in order to be widely adopted, users need the ability to choose where and when they want to use access keys so that they can easily switch between ecosystems.”
Password Manager Dashlane already knows how to store passwordsand on Wednesday added the opportunity login to your password manager with a password instead of the master password too.
“By eliminating the master password, Dashlane will allow users to create new password-free phishing-resistant accounts that are free from the vulnerabilities of traditional passwords and multi-factor authentication,” the company said, arguing that access keys are also easier to use than passwords. .