Google adds support for passkeys to protect your account

[AlphaX]

Forward-looking: Lately, the most common way to protect accounts and data has been through the use of passwords and two-factor authentication (2FA). While 2FA is secure, hackers are managing to find new ways to crack it. To circumvent this, Google is implementing a better method of securing Google accounts.

Passkeys are a new and convenient method of logging into your various accounts and devices. The push to make passkeys the "norm" was spearheaded by a group known as the "FIDO Alliance," consisting of numerous companies such as Microsoft, Apple, Google, and many more. The hope is that passkeys will not only replace passwords but entirely eradicate them.

Unlike passwords and 2FA codes, which can be easily cracked or phished, passkeys are much more difficult to break through. When a passkey is created, it generates a public and a private key. The public key is stored on the website for the account; however, this cannot be used by hackers to grant access.

The private key is stored and encrypted within your device and can only be confirmed through biometric data. This private key contains all the information that will allow you to access your account. What this means is that nobody besides you should be able to get to your data under any circumstances.

(click to enlarge)

Enabling the new passkey feature is also very simple. If you have a recently released Android device, you will notice there is already a pre-made passkey for that phone or tablet. However, you will still need to enable passkeys on your account. To find the setting, follow these steps:

• 1. Go to myaccount.google.com on your device.
• 2. Click the "Security" tab located on the left side of the screen.
• 3. Click the "Passkeys" tab located within the "How you sign in to Google" category.
• 4. Click "Use passkeys" and you're good to go!

This is also not Google's first voyage into the world of passkeys. Last December, Google introduced passkeys to their Chrome browser. Currently, the amount of passkey support within websites is very low, but Google expects the number to increase greatly in the coming years. This list shows the sites that use passkeys right now.

Overall, it's a great sign to see Google put a heavy emphasis on user security and privacy. As hacking methods have become more intricate, the good old password and 2FA protection are beginning to feel less safe. We can hope that Google's push to make passkeys the new norm leads other companies like Apple, Microsoft, Amazon, etc. to also integrate these better options.

Permalink to story.

https://www.techspot.com/news/98551-google-adds-support-passkeys-protect-account.html

 

[human7]

"The private key is stored and encrypted within your device and can only be confirmed through biometric data."

This line immediately raised red flags for me: any security researcher will tell you that biometric data is, at best, the equivalent of a username. Not a password.

Even so, I'll wait and see. The big question to me is how this is different from your typical asymmetric key encryption. Maybe it's just an easier interface to that?

 

[mbrowne5061]

"The private key is stored and encrypted within your device and can only be confirmed through biometric data."

This line immediately raised red flags for me: any security researcher will tell you that biometric data is, at best, the equivalent of a username. Not a password.

Even so, I'll wait and see. The big question to me is how this is different from your typical asymmetric key encryption. Maybe it's just an easier interface to that?

That, and biometric data has fewer legal protections than passwords do (in the US). You only need to hand over your password if ordered to by a court - the police can't compel you to. But biometric data? Courts have previously ruled that its "public" and police can compel you to unlock biometrically-locked devices and accounts, so I doubt passkeys will be any different.