Apple, Google and Microsoft are planning to expand support for a common passwordless sign-in standard created by the FIDO Alliance and the World Wide Web Consortium, in a joint effort to make the web more secure and usable for all.
The new capability will allow websites and apps to offer consistent, secure and easy passwordless sign-ins to consumers across devices and platforms.
Password-only authentication is one of the biggest security problems on the web, and managing so many passwords is cumbersome for consumers, which often leads consumers to reuse the same ones across services. This practice can lead to costly account takeovers, data breaches and even stolen identities.
While password managers and legacy forms of two-factor authentication offer incremental improvements, there has been industry-wide collaboration to create sign-in technology that is more convenient and more secure.
The expanded standards-based capabilities will give websites and apps the ability to offer an end-to-end passwordless option. Users will sign in through the same action that they take multiple times each day to unlock their devices, such as a simple verification of their fingerprint or face, or a device PIN.
This new approach protects against phishing and sign-in will be radically more secure when compared to passwords and legacy multi-factor technologies such as one-time passcodes sent over SMS.
Hundreds of technology companies and service providers from around the world worked within the FIDO Alliance and W3C to create the passwordless sign-in standards that are already supported in billions of devices and all modern web browsers. Apple, Google and Microsoft have led development of this expanded set of capabilities and are now building support into their respective platforms.
These companies’ platforms already support FIDO Alliance standards to enable passwordless sign-in on billions of industry-leading devices, but previous implementations require users to sign into each website or app with each device before they can use passwordless functionality.
The announced plans extend these platform implementations to give users two new capabilities for more seamless and secure passwordless sign-ins.
One allows users to automatically access their FIDO sign-in credentials or “passkey” on many of their devices, even new ones, without having to re-enroll every account.
Another enables users to use FIDO authentication on their mobile device to sign-in to an app or website on a nearby device, regardless of the OS platform or browser they are running.
In addition to facilitating a better user experience, the broad support of this standards-based approach will enable service providers to offer FIDO credentials without needing passwords as an alternative sign-in or account recovery method.
These new capabilities are expected to become available across Apple, Google and Microsoft platforms over the course of the coming year.
