What if you never had to type in a password again? Imagine. An international day of celebration. Children dancing in the streets. Soldiers laying down their arms and hugging tearfully across the battlefield.
Or, at least, a mild improvement in your daily life. That’s what Apple, Google and Microsoft are offering, with a fairly rare triple announcement that the three tech giants are all adopting the Fido standard and ushering in a passwordless future. The standard replaces usernames and passwords with ‘passkeys’, log-in information stored directly on your device and only uploaded to the website when matched with biometric authentication like a selfie or fingerprint. From Apple’s announcement:
Users will sign in through the same action that they take multiple times each day to unlock their devices, such as a simple verification of their fingerprint or face, or a device PIN. This new approach protects against phishing and sign-in will be radically more secure when compared to passwords and legacy multi-factor technologies such as one-time passcodes sent over SMS.
The three companies will roll out Fido support “over the course of the coming year”. The Fido2 standard is actually already public, and some companies support it already, largely for internal authentication. But the standard has long lacked the final step necessary for ubiquity: making it easy to get started.
That’s what this latest announcement is about. With the help of the platform owners, users will be able to sync their Fido “passkeys”, without needing to log in fresh on each new device. That takes it from a service that is nice addition to passwords, to one that can be fully used to replace them.
Ease of use is only part of the reason for the switch. Passkeys, secured with biometric identification on your phone, are faster than manually entering passwords, but if you use a password manager (and you should use a password manager) you’ll be able to enter passwords and login to most websites at the tap of a (fingerprint sensing) button anyway.
But the bigger reason is that passwords suck. They suck because of how they are used in practice: people make short, easy-to-guess passwords, and then re-use them across the internet. For many users, the more important a website is, the more likely the password is to be short and easy-to-guess, because while you may tolerate entering a long, secure password once or twice, you won’t bother doing it several times a day.
And the ways we’ve tried to fix passwords … also suck. Requirements to add complexity to passwords, in an attempt to make it harder to break them by brute force, are notoriously infuriating, and frequently inept at securing the actual outcome they’re seeking: if “P@ssword1” is a valid password but “doubloon prorogue tunnel” (to offer a passphrase randomly generated by my password manager just now) isn’t, you’ve just reduced the security of someone’s account.
Two-factor authentication, which asks you to link a second “factor” to your account – such as a phone number which gets texted, or another device, which you use to approve the login – has its own problems. The most popular forms of two-factor authentication all involve the use of one-time passcodes, either texted to you or generated by an app on your phone or computer. And those one-time passcodes are just as open to phishing as a conventional password, albeit with a shorter expiration date if they’re successfully stolen.
And so, if the Fido thing takes off, the world should get slightly more secure, slightly less frustrating and slightly smoother to move through.
What will it look like for you? Probably not that different in practice. One day, you’ll be making an account on a website and just … won’t be asked for a password. You might not even notice it happens. But rest assured: the children will be dancing in the streets anyway.
If you want to read the complete version of the newsletter please subscribe to receive TechScape in your inbox every Wednesday.
