Google announced the ability to set a passkey by default for all users on Tuesday, five months after launching support for the FIDO Alliance-backed passwordless standard for Google Accounts on all platforms.
“This means that the next time you sign in to your account, you’ll be asked to create and use a passkey, making your future sign-ins easier,” said Google’s Sriram Karra and Christiaan Brand.
“This also means you’ll see the ‘Skip passwords when possible’ option turned on in your Google Account settings.”
Passkeys are a new form of authentication that eliminates the need for a username and password altogether, or even provides any additional authentication factors.
In other words, it is a passwordless login mechanism that leverages public-key cryptography to authenticate users’ access to websites and apps, with the private key stored securely in the device and the public key stored in the server.
Each passkey is unique and bound to a username and a specific service, meaning a user will have at least as many passkeys as they have accounts, although there can be multiple passkeys per account since passkeys function only within the confines of the same platform.
Therefore, a user can have one passkey each for a website for Android, iOS, and Windows.
Thus, when a user signs into a website or app that supports passkeys, a random challenge is created and sent to the client, which, in turn, prompts the individual to verify using their biometric or a PIN in order to sign the challenge using the private key and send it back to the server.
Authentication is considered successful if the signed response can be validated using the corresponding public key.
The immediate benefit of passkeys is two-fold: they not only relieve the hassle of remembering passwords, but are also phishing-resistant, thereby protecting accounts against potential takeover attacks.
This development comes just weeks after Microsoft officially introduced Passkey support in Windows 11 for better account security. Other widely used platforms like eBay and Uber have enabled passkey support in recent months.