Join top executives in San Francisco on July 11-12 to hear how leaders are integrating and optimizing AI investments for success. Learn more
Today, Google announced that it is rolling out passkey support for Google accounts on all major platforms. Starting today, users can now use passkeys for a passwordless login experience to apps and websites using fingerprints, facial recognition, or a local PIN without having to enter a password or complete two-step verification (2SV).
To configure a password, users can visit a website or app, log in using their existing username and password, then choose to create a password that can then be stored in a solution such as Google Password Manager to log in in the future.
Unlike passwords, passkeys cannot be stolen, making them resistant to credential theft, phishing, and social engineering. As a result, broader support for passwordless sign-ins will make Google accounts more resistant to identity-based attacks.
“Passkeys are a more convenient and secure alternative to passwords,” write Google software engineers Arnar Birgisson and Diana K. Smetters in the official blog post. “Even the most savvy users are often tricked into giving them up during phishing attempts.”
Password-based security is inefficient for modern enterprises
The release comes as the weaknesses of password-based security become increasingly apparent, with hackers leaking more than 721 million passwords online last year. Vendors, including Microsoft and Apple, have committed to developing a common standard for passwordless login.
While existing technologies such as multi-factor authentication (MFA) have helped improve online account security, they have not fully addressed the risk of credential theft due to their susceptibility to SIM-swap attacks that hijack the SMS verification process, and the inconvenience of adding additional authentication steps for end users.
Passwordless login options, such as password keys that allow users to log in with biometrics, provide an easy-to-use alternative that reduces the likelihood of a successful account takeover attempt.