Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Google Chrome Gains Support for Passkeys, Making it Easier to Log Into Websites and More

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
67,597
37,980


Google Chrome has announced it has gained support for passkeys, a new industry-wide standard with the hope of replacing passwords by making it easier and safer to log into websites and apps.

Passkey-Feature-Triad.jpg

With passkeys, users can authenticate and log into websites using their iPhone or Android devices, replacing the need for a password. On newer versions of iOS and Android, users visiting websites that support passkeys can use biometric authentication on a trusted device to confirm their identity. Writing in a blog post, Google said it was adding passkey support to Chrome, which will let users scan a QR code on their Android or iPhone device to log in. Passkey support is also coming to Chrome on Android.
On a desktop device you can also choose to use a passkey from your nearby mobile device and, since passkeys are built on industry standards, you can use either an Android or iOS device. A passkey doesn't leave your mobile device when signing in like this. Only a securely generated code is exchanged with the site so, unlike a password, there's nothing that could be leaked.
Click to expand...
A number of other companies and apps have introduced or announced upcoming support for passkeys, including 1Password, PayPal, Microsoft, eBay, and more. Passkey support in Google Chrome is available now with the latest update. To learn more about passkeys, check out our explainer.

Article Link: Google Chrome Gains Support for Passkeys, Making it Easier to Log Into Websites and More
 
Article Link
https://www.macrumors.com/2022/12/10/google-chrome-passkey-support/
  • Like
Reactions: Leon Ze Professional
Danfango said:
More parties to rely on at an authentication boundary is not necessarily a better thing. You are at the mercy of everyone one of them.

I will continue to use MacPass and keep everything in a domain I fully control.
Click to expand...
I don't understand this comment. For most people, Passkeys won't increase the number of parties involved in the authentication process. Assuming of course, that most people, like you seem to do, use a tool to store their passwords. With Passkeys, what's being transferred between authenticatee and authenticator is different (not a password) but other than that, the process is very similar. A "secret" held on your client (probably using a software tool or the built-in key-chain) is used to authenticate with the target website.
 
  • Like
  • Love
Reactions: sydneysider88, Louisdi, blizzerand and 10 others
Danfango said:
More parties to rely on at an authentication boundary is not necessarily a better thing. You are at the mercy of everyone one of them.

I will continue to use MacPass and keep everything in a domain I fully control.
Click to expand...
It’s just asymmetric key cryptography. There is no third party other than your key storage provider, let it be your trusted Apple devices’ Secure Enclave or 1Password vault or Google‘s vault or multiple vaults.

Its similar to GPG.
 
  • Like
  • Love
Reactions: sydneysider88, DeepIn2U, Louisdi and 14 others
h3ysw5nkan said:
It’s just asymmetric key cryptography. There is no third party other than your key storage provider, let it be your trusted Apple devices’ Secure Enclave or 1Password vault or Google‘s vault or multiple vaults.

Its similar to GPG.
Click to expand...

Yes that's the problem. Your vault is most likely to be synced with iCloud which means the SPOF is iCloud as always.
 
  • Disagree
  • Haha
  • Like
Reactions: thewebb, blizzerand, cyanite and 1 other person
I hope passkeys remain optional forever. It sounds like a system that requires having a mobile device on you at all times, I'd hate to keep unlocking my phone just to log in to a website on the desktop. Having a password manager is so much simpler.
 
  • Like
Reactions: psxp, sydneysider88, bobcomer and 2 others
Has anyone seen any of the big sites out there supporting Passkeys/WebAthn yet? I’ve yet to come across one in the wild. I saw articles that PayPal was starting to roll it out in October, but it hasn’t shown up for me as an option yet.
 
  • Like
Reactions: mainemini and TheYayAreaLiving 🎗️
macintologist said:
What if you use a desktop Mac with no WebCam and no touch ID on the keyboard?
Click to expand...
With Safari, you use your login password to create and use passkeys. Only requirement is Safari 16.1 and having iCloud Keychain enabled.

I don’t use Chrome so I don’t know how it works there
 
  • Like
Reactions: kitKAC
MacRumors said:
With passkeys, users can authenticate and log into websites using their iPhone or Android devices, replacing the need for a password.
Click to expand...
What about authenticating with an iPad or Apple Watch? Will I have to use my iPhone to authenticate even when I’m using an iPad to access a web site?
 
beanbaguk said:
If this becomes a standard, 1Password could see a massive decline in users…
Click to expand...
I think the opposite. Passkey is limited in a lot of ways.

By relying on either company to eliminate passwords, you’re effectively locking yourself into their respective platforms.
Click to expand...
It will not be easy to switch from Android to iPhone at all and vice versa. It can be done, but it won't be easy at all.

The other issue is sharing Passkeys. My wife and share passwords for our bills, how can you do this with Passkey? You can't unless both are Apple. This again where a password manager will shine. My wife can use the vault we share passwords, we can share Passkeys very easily.

Another issue is when you login into a computer and your Passkey is on your phone. Yes, there will be a QR code, scan with your phone, and log in, but password managers are cross platform. I have my Password Manger on all of my devices, so I can easily log into a website without having my phone with me. 1Password also made a way to log into a computer that isn't yours easily (article below), and I bet Bitwarden and others will follow.

Work Passwords... I read an article about work passwords, how this will be an issue (I wish I kept that article). It's probably not an issue now, because it will take years before Passkey takes off.

Password managers are superior in this way, and just switching/cross platforms alone are worth it.

Here is the article about how 1Password will handle Passkeys (and where I got the quote above). Please note, I bet money Bitwarden and others will do the same, and it's great. They will make it easy to switch Password Managers with Passkeys also.

Passwords aren't going away anytime soon, so password are going to be around for years. Not every wedsbite is going to change overnight to Passkey.
 
Last edited:
  • Like
Reactions: blizzerand, GlassFingers, beanbaguk and 1 other person
So if you lose a passkey will you still be able to ‘reset’ your website login using your email?

Without 2FA, many websites/services have stopped using passwords altogether. They just send an email with a code or link. Why? Because if you say your forgot your password, they just send you a email to reset it anyways. Might as well skip the password step altogether. Some even consider email to be a 2FA choice, which makes no sense, as you can just reset your primary authentication over email.

But this means if an attacker gains email access they can reset your password on almost every website.

If you lose a passkey and have to reset a website, how would you prove yourself with 2FA? As soon as you put a phone number as a backup, you are significantly reducing the security.

I don’t get it personally. The general public is generally not that intelligent when it comes to internet security. People are just going to end up locked out of their all accounts and have no idea why.

We use 1Password Enterprise at work and I’m constantly having to recover employee accounts.
 
Last edited:
  • Like
Reactions: DeepIn2U, jinnj and CarAnalogy
AppleTO said:
If you lose a passkey and have to reset a website, how would you prove yourself with 2FA? As soon as you put a phone number as a backup, you are significantly reducing the security.
Click to expand...
From what I am reading, your phone/devise will prove who you are. Unless someone has your phone, they aren't getting in.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back