Google is making it easier for people to lock their accounts with multifactor authentication by adding the option to store secure cryptographic keys in passkeys rather than on physical token devices.
Google introduced the Advanced Protection Program in 2017. This program requires the strongest form of multifactor authentication (MFA).
Whereas many forms of MFA rely on one-time passcodes sent through SMS or emails or generated by authenticator apps, accounts enrolled in advanced protection require MFA based on cryptographic keys stored on a secure physical device.
Unlike one-time passcodes, security keys stored on physical devices are immune to credential phishing and can’t be copied or sniffed.
Advanced Protection Program requires the key to be accompanied by a password whenever a user logs into an account on a new device.
The protection prevents the types of account takeovers that allowed Kremlin-backed hackers to access the Gmail accounts of Democratic officials in 2016 and go on to leak stolen emails to interfere with the presidential election that year.
Until now, Google required people to have two physical security keys to enroll in the app. Now, the company allows people to use two passkeys or one passkey and one physical token. Those seeking further security can enroll using as many keys as they want.
He said the move comes in response to comments Google has received from some users who either couldn’t afford to buy the physical keys or lived or worked in unavailable regions.
As always, users must still have two keys to enroll to prevent being locked out of accounts if one of them is lost or broken.
While lockouts are always a problem, they can be much worse for APP users because the recovery process is much more rigorous and takes much longer than for accounts not enrolled in the program.
Google makes it easier for people to secure their accounts with multifactor solid authentication using passkeys instead of physical security keys.
Google’s Advanced Protection Program (APP) is a strong account security option that requires two physical security keys for enrollment.
Now, Google allows people to use passkeys instead of physical keys to enroll in APP.
Passkeys are a new, more secure alternative to passwords that use your device’s built-in biometrics, such as your fingerprint, face scan, or screen lock, to authenticate you.
Passkeys are stored locally on your device and provide two-factor authentication – something you know and your device.
This makes the app more accessible, as many people already have a phone or computer that can be used for passkeys rather than needing to purchase physical security keys.
Google is expanding access to its highest security tier (APP) by allowing passkeys, which are more convenient and affordable than physical security keys.
This helps “democratize” access to this advanced protection, as some users previously couldn’t afford or access physical security keys, especially in certain regions.
Users still need two authentication factors to enroll in the app, but they can now use a mix of passkeys and physical keys.
Google still recommends providing backup recovery options like a phone number, as account recovery for APP accounts is more rigorous.
Also Read: Whatsapp Brings A New Era Of Security And Convenience With Passkey Support