Kill the password
Apple, Google, and Microsoft have launched a “joint effort” to kill the password. They support a common passwordless sign-in standard created by the FIDO Alliance and the World Wide Web Consortium.”
Instead of a long string of characters, this new scheme would have the app or website push a request to your phone for authentication. You’d need to unlock the phone, authenticate with some pin or biometric, and then you’re on your way. The FIDO scheme works over Bluetooth, which requires physical proximity, a phishing-resistant way to leverage the user’s phone during authentication.
The FIDO blog post says: “These new capabilities are expected to become available across Apple, Google, and Microsoft platforms over the course of the coming year.” Apple, which seems to have started the whole “passkey” trend, already has a system up and running in iOS 15 and macOS Monterey, but it is not compatible with other platforms yet. Google’s passkey support has already appeared in Play Services on Android.
Kurt Knight, Apple’s senior director of platform product marketing, said working with the industry to establish new, more secure sign-in methods was “central to our commitment to building products that offer maximum security and a transparent user experience. “We look forward to making FIDO-based technology available across Chrome, ChromeOS, Android and other platforms, and encourage app and website developers to adopt it,” Google’s senior director of product management, Mark Risher, said. “The complete shift to a passwordless world will begin with consumers making it a natural part of their lives,” said Alex Simons, corporate vice-president, identity programme management at Microsoft.
The open industry association said the new approach would protect users against phishing.