Passwords or Passkeys?

Google has announced that passkeys are now rolling out to Google Account users globally. The news comes nearly 12 months after Google, Apple, Microsoft, and the FIDO Alliance announced a partnership to make frictionless ‘passwordless’ logins a reality across devices, operating systems, and browsers. Multi-factor authentication mechanisms and password managers offer reasonable security improvements on traditional username/password workflows, but are not without their flaws. An authentication code sent via SMS can be intercepted, for example, while having to use additional third-party password management software can be challenging. With passkeys, users’ authentication essentially synchronizes across all their devices through the cloud using cryptographic key pairs, allowing users to sign-in to websites and apps using the same biometrics or screen-lock PIN they use to unlock their devices. This makes it far more difficult for bad actors to access users’ accounts remotely, since physical access to the user’s device is needed.