Goodbye passwords, forward passkeys. The similarity of the terms might make one think of a minor change, but the technological leap is important, especially since the new system is more practical and secure than the old one. While other companies have already offered the opportunity to do without passwords in certain circumstances or individual markets (such as PayPal with the US market), Google‘s announcement is surprising since the roll-out of the new feature for the Big G ecosystem is immediate and concerns many international markets.
A novelty compared to the usual, when at least in the first phase, innovations are tested in small doses. In any case, the possibility of using a passkey to access Google accounts means that no more passwords will have to be entered, to the delight of those who struggle to remember their keywords or who forget them because of the large number of different passwords that have to be kept in mind.
The difference between passwords and passkeys
The difference with passwords is that the passkey exists only on the device in use, which is a marked improvement in data protection since there are no traceable secret words; any phishing attack would have no consequences. No password is also equivalent to bypassing two-step verification precisely because it is sufficient to activate the passkey quickly and intuitively. Also, from now on, one can use a local pin or a biometric recognition solution, such as a fingerprint or one’s own face, to securely access one’s Google account.
Passkeys for Google accounts, on the other hand, are stored on compatible devices, particularly with devices upgraded to iOS 16 and the green robot’s devices running Android 9, and can be shared with other devices via iCloud (so by saving the passkey on the iPhone, it will also allow access to the Mac) or password management services such as 1Password.
Basically, with this method, access is based on the connection that is made between the Google account and the device – smartphone, tablet, laptop, nothing changes – with authentication taking place, in fact, by entering the envisaged numerical sequence or one’s finger or Face ID, which is needed to unlock the device.
Looking at how it works, the two cryptographic keys are generated only once, with subsequent logins only taking place by entering the pin or biometric recognition of choice to be associated with the passkey in question. Once the passkey is created, the authentication process is identical to what we already do when using banking apps with our fingerprint or downloading an app on the iPhone using FaceID.
A more secure method
Of course, the system also allows access to one’s account from another person’s computer: to do so, there is the option ‘use passkeyson another device‘, which creates the access code aimed at the individual and immediate use without leaving a trace on the device being used. In case one loses one’s device that has already been authenticated, or there is a suspicion that a stranger may have access to one’s account, one can instantly revoke the passkey by fishing for the option in the Google account settings.
On the security side, Google has specified that the user’s biometric data are not shared with the company nor with third parties under any circumstances; while comparing passkeys and passwords, it is evident that there are now no numbers or letters to keep in mind and the worry of choosing too simple secret passwords, potential targets of cybercriminals, falls away.
Currently, however, passwords remain available to those with a Google account. The switch to passkeys will be gradual to facilitate even those unfamiliar with new technical solutions. Leaving the world of Big G, on the other hand, a little patience will be needed for the widespread diffusion of passkeys. However, it is now expected that Apple and Microsoft will soon strike a blow in the same direction: the farewell to passwords is now only a matter of time.
