Passkeys: all the news and updates around passwordless sign-ins

WhatsApp is introducing a passwordless way to instantly secure your chat backups. The messaging platform is launching passkey-encrypted backups for iOS and Android, allowing users to quickly encrypt their stored message history using their face, fingerprint, or device screen lock code.

The update is rolling out “gradually over the coming weeks and months,” according to WhatsApp, and will make it easier to apply the same security measures that protect personal chats and calls to backups. End-to-end encryption for backups was already introduced in 2021, but required WhatsApp users to save a 64-digit encryption key or create a password tied to the key.

Facebook is adding support for passkeys on its mobile app. That means you’ll be able to log into the platform using your device’s authentication method, like your fingerprint, face scan, or PIN, making it more difficult for bad actors to take control of your account.

Passkeys offer a more secure alternative to typical passwords because they can’t be stolen, guessed, or leaked. They also provide protection against phishing scams, which occur when a bad actor attempts to trick victims into exposing personal information, often by linking to fake login pages. Since your browser automatically links your passkey with a specific domain, it won’t trigger passkeys on phony webpages.

After supporting passwordless Windows logins for years and even allowing users to delete passwords from their accounts, Microsoft is making its biggest move yet toward a future with no passwords. Now it will ask people signing up for new accounts to only use more secure methods like passkeys, push notifications, and security keys instead, by default.

The new no-password initiative by Microsoft is accompanied by its recently launched, optimized sign-in window design with reordered steps that flow better for a passwordless and passkey-first experience.

The FIDO Alliance, the organization that’s helping shepherd passkey adoption, announced a draft of new specifications that would let users securely move their passkeys across different password managers.

Passkeys are great — it’s nice to be able to log in to apps and websites without entering a password. But there hasn’t been a standard protocol for transferring your passkeys across password managers. The new specifications, the Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF), are designed to fill that gap.

Google is improving passkey support in Chrome by making it easier to use the passwordless sign-in credentials across different devices. The search giant is introducing a Google Password Manager PIN that allows users to securely save and synchronize passkeys for use across Windows, macOS, Linux, and Android devices. These updates are available in beta on ChromeOS as well, with iOS support “coming soon.”

Passkeys needed to be saved to Google Password Manager on Android prior to this update and required users to scan a QR code on their Android device to access them on other platforms. The new PIN replaces the need to scan the QR code while ensuring that your saved passkeys remain protected by end-to-end encryption, so not even Google can access them. Users will need to either unlock their Android screen or use their Password Manager PIN to use passkeys on a new device.

Do you know what’s on your portable drives? Or where you saw them last? Are they ready to store and share massive gobs of video? Are they blazing fast?

The Iodyne Pro Mini is designed to be the (pricey) answer to all of that.

Password manager Dashlane has released a new passkey report that gives us some idea of how many people are adopting the cryptographic passwordless logins. According to the report, Dashlane has seen a 400 percent increase in passkey authentications since the beginning of the year, with 1 in 5 active Dashlane users now having at least one passkey in their Dashlane vault.

Over 100 sites now offer passkey support, though Dashlane says the top 20 most popular apps account for 52 percent of passkey authentications. When split into industry sectors, e-commerce (which includes eBay, Amazon, and Target) made up the largest share of passkey authentications at 42 percent. So-called “sticky apps” — meaning those used on a frequent basis, such as social media, e-commerce, and finance or payment sites — saw the fastest passkey adoption between April and June of this year.

AI was the main focus of the Google I/O keynote this year, but there are still a bunch of new feature updates hidden in the various developer sessions. Case in point, 9to5Google spotted that Android 15 and Wear OS 5 are going to get some convenient passkey updates.

In its “Passkeys and identity best practices” dev session, Google announced that Android 15 is going to get a single-tap sign-in process. Instead of having two separate screens — one to select an account and another for a biometric prompt — Google will merge them into a single screen.

Google is streamlining the process of setting up two-factor authentication (2FA). Instead of entering your phone number first to enable 2FA, you can now add a “second step method” to your account such as an authenticator app or a hardware security key to get things set up.

This should make it safer to turn on 2FA, as it lets you avoid using less secure SMS verification. You can choose to enter a time-based one-time passcode through apps like Google Authenticator, or you can follow the steps to link a hardware security key.

Microsoft is fully rolling out passkey support for all consumer accounts today. After enabling them in Windows 11 last year, Microsoft account owners can also now generate passkeys across Windows, Android, and iOS. This makes it effortless to sign in to a Microsoft account without having to type a password in every time.

You can create passkeys for your Microsoft account by following this link, and you can choose your face, fingerprint, PIN, or a security key to use a device to sign in with a passkey.

Google is kicking off World Password Day by updating us on its efforts to replace the often hacked, guessed, and stolen form of authentication with passkeys. Their passwordless approach relies on device-based authentication instead, making logging in faster and more secure.

In a blog post on Thursday, the company announced that over 400 million Google accounts (of the at least 1.5 billion reported since 2018) have used passkeys since rolling them out, logging over a billion authentications between them. The majority of users find them easier to use than passwords, according to Google, adding that “since launching, passkeys have proven to be faster than passwords, since they only require users to simply unlock their device using a fingerprint, face scan or pin to log in.”

One more app joins the passwordless future we’ve been promised. WhatsApp says it’s now rolling out support for passkeys in the iOS version of the app. With the feature enabled, users of Meta’s encrypted messaging app can use iPhone biometrics for login — that is, Face ID or Touch ID — or their phone’s passcode.

WhatsApp already supports unlocking its iOS app with one of these options, but this takes that a step further. Passkey support comes to the iPhone version several months after Meta started distributing it to Android WhatsApp users in October. WhatsApp spokesperson Zade Alsawah iOS users will see the app “in the coming weeks,” so if you don’t see it now, keep checking.

Passkeys: how do they work? No, like, seriously. It’s clear that the industry is increasingly betting on passkeys as a replacement for passwords, a way to use the internet that is both more secure and more user-friendly. But for all that upside, it’s not always clear how we, the normal human users, are supposed to use passkeys. You’re telling me it’s just a thing... that lives on my phone? What if I lose my phone? What if you steal my phone?

On this episode of The Vergecast, we bring in an expert: Anna Pobletts, the head of passwordless (best title ever?) at 1Password. She has been working on all things post-password for a long time and has seen every use case you can think of. She’s convinced that passkeys are the future but also has some ideas on the right (and not-so-right) way to get started.

X is now supporting passkey log-ins on iPhones and iPads, granting members access to the security feature regardless of their “Premium” status. Generating a passkey for X allows users to completely skip entering a password when they log in to their accounts and instead rely on the device’s security (with Face ID, Touch ID, or your device’s passcode).

For now, passkeys are only available in the US, and X hasn’t revealed when it’s rolling out the login technology on Android, for desktop operating systems, or in other countries. Also, X’s rollout of passkeys doesn’t seem to be complete yet (some users reported still not having access as of Tuesday night on the East Coast), so don’t fret if the feature hasn’t popped up yet.