Passkeys Simplify Enrolment for Google’s ‘Advanced Protection Program’

Google has simplified the enrollment process for its Advanced Protection Program, which is designed for individuals at higher risk of targeted online attacks, such as political campaign workers and journalists.

Previously, users needed two physical security keys to set up the program. Now, users can set it up using a single passkey, leveraging the built-in biometric authentication of Pixel phones or iPhones.

Google launched the Advanced Protection Program in October 2017. The Program requires additional recovery methods like a phone number, email address, or a second passkey to ensure users can regain access if locked out.

Passkeys are a passwordless login method that use cryptographic keys to securely authenticate users. Instead of relying on traditional passwords, passkeys employ a pair of keys: a public key stored on the server and a private key stored on the user’s device.

When a user attempts to log in, the device signs a challenge from the server with the private key, and the server verifies this signature with the public key. This approach uses biometric authentication to ensure that only the device owner can access the account.

The idea of passkeys was developed by the FIDO Alliance, a consortium of tech companies including Google, Microsoft, and Apple, established to address the lack of interoperability among strong authentication devices and reduce reliance on passwords.

The concept of passkeys and the FIDO2 standard, which underpins this technology, began to take shape in the early 2010s. In 2013, the FIDO Alliance published its first set of specifications. The U2F (Universal 2nd Factor) standard, an early iteration, laid the groundwork for what would become FIDO2.

By 2018, the FIDO2 standard was finalized, incorporating the WebAuthn API, which allowed for broader adoption across web browsers and services. In recent years, major tech companies have begun implementing passkeys, making them an increasingly practical alternative to traditional passwords.

Source: The Verge

–

July 10, 2024 – by Cass Kennedy