Companies unite to begin putting an end to the reign of passwords

Since Apple, Google and Microsoft started looking for alternatives to passwords, their end seems closer and closer. In 2022, these three companies adopted the so-called “passkeys” (or access keys), a technology that allows you to log in to websites and applications securely through facial recognition, biometrics or PIN.

The idea is simple: if you don't need to create or remember passwords, the chances of falling for scams phishing decrease. Additionally, with websites no longer storing their customers' passwords, security breaches become less dangerous.

While passkeys have generated initial excitement, their implementation has been confusing. Sites and applications have dealt differently with the idea of ​​not needing passwords, and storing passwords passkeys in third-party managers it proved complicated.

The biggest problem is that there is still no way to transfer all keys to other platforms or password managers, which ends up locking users into the ecosystem they already use.

But finally, that's about to change. The FIDO Alliance, a group leading the adoption of passkeys, is creating guidelines to make use of the passkeys passkeys more consistent across different sites, and major technology platforms are improving compatibility with users' chosen password managers.

The group is also developing a protocol so that people can safely migrate between managers, taking all their access keys with them.

These changes make the adoption of passkeys practically inevitable, especially with large companies e-commercesuch as Amazon and Shopify, embracing the new development. Even if you're not yet on top of this trend, it will soon be difficult to avoid.

“In the next three to five years, virtually every major service will offer a passwordless option to consumers,” predicts Andrew Shikiar, CEO and executive director of the FIDO Alliance.

ENCOURAGING ADOPTION

One of the biggest challenges is user inertia. People still haven't gotten used to the idea of ​​passwordless login, and setting up a passkey can be a somewhat confusing and cumbersome process, especially when it interrupts browsing.

While there is no easy solution, FIDO created the website Passkey Central to help companies overcome these obstacles. The page also suggests strategies to encourage the adoption of passkeys and encourages standardization of icons and messages.

“We can help make the adoption of passkeys a more natural and less frictional process for users,” says Nick Steele, product manager at 1Password. “Today, the biggest challenge is getting them to take that first step.”

PORTABILITY

Even though it becomes easier to store passkeys in your favorite password manager, there isn't a way to transfer them yet. If you've been using 1Password for a long time and want to switch to Apple's Passwords app, the keys you created in 1Password remain there.

However, the FIDO Alliance is proposing a solution with the Credential Exchange Format (credential exchange format) and the Credential Exchange Protocol (credential exchange protocol). The first provides a universal format for logins, while the second specifies how managers can transfer this data between each other.

If you don't need to create or remember passwords, the chances of falling for internet scams decrease.

These protocols are not just for access keys; they can also be used for traditional passwords, offering a secure way to change managers. Today, the only option is to export a .CSV spreadsheet with all the logins and upload it elsewhere, but anyone with access to the file will be able to see this information.

Although these protocols are still in their early stages, the goal is to ensure secure data exchange between platforms. “We want security, interoperability and competitiveness, and we have seen this happen”, says Andrew Shikiar, from FIDO.

GAINING STRENGTH

Shikiar is pleased with the progress of access keys over the past two years. He cites a recent survey by the FIDO Alliance, which shows that 40% of consumers already know the passkeysand mentions an Amazon announcement that revealed that 175 million customers have already activated this option on their accounts.

The next big objective is to convince the financial sector to also adopt them. Initial uptake has been concentrated in the e-commerce and hospitality, where ease of access is a priority, but adoption by financial services would go a long way toward bolstering the security benefits of access keys.

When that happens, Shikiar believes passwords will start to become obsolete. “Of course, in five years there will still be situations where we use passwords,” he says, “but less and less.”

---

ABOUT THE AUTHOR

Jared Newman covers apps and technology from his remote outpost in Cincinnati. He also writes two newsletters, Cord Cut… find out more

---