Google introduces passkeys

Google has announced that it will offer the option of logging in via passkeys with immediate effect. These are to replace classic passwords as well as two-factor authentication at Google in the long run. For the time being, however, the previous login options will remain.

Passkeys to replace passwords

The Fido Alliance, which includes Google and Microsoft, for example, introduced Passkeys as a verification option last year. The new login method is intended to replace passwords and two-factor authentication in the long term. The principle is relatively simple: When a login attempt is made, a message is sent to a stored device on which authentication must take place via fingerprint or face scan in order for the login attempt to succeed. A password is thus replaced by the availability of a specific device and certain biometric data.

Compared with conventional password protection, this new method offers greater security because the data required for logging in cannot simply be stolen in the course of a cyber attack or phishing attempt. Compared to two-factor authentication, the primary advantage is that passkeys are more convenient to use. However, being tied to a specific device also brings disadvantages. If the device is lost, for example, a recovery of the master key must be performed via a cloud. The advantages of purely local storage are partially offset by the cloud protection required for this – after all, just like passwords stored in encrypted form, they are potentially compromisable thanks to the Internet connection. The biometric data, on the other hand, should be stored exclusively locally on the device.

Alternatives remain in place for the time being

For the time being, however, Google will not abolish the previous login options. This is also due to the fact that passkeys are not yet widespread and accordingly few people are likely to be familiar with them. Skepticism, justified criticism and a period of acclimatization are thus to be expected. It remains to be seen whether Google will actually do away with passwords and two-factor authentication completely. For this to happen, the new technology would have to be accepted by users on a broad level.