More than 400 million Google accounts used passkeys

Google is kicking off World Password Day by updating us on its efforts to replace the oft-hacked, guessed, and stolen form of authentication with passkeys. Its passwordless approach relies on device-based authentication, making login faster and more secure.

In a blog post on Thursdaythe company announced that more than 400 million Google accounts (at least 1.5 billion reported since 2018) have used access keys since they were launched, recording more than a billion authentications between them. Most users find them easier to use than passwords, according to Google, adding that “since launch, passkeys have proven to be faster than passwords because they only require users to simply unlock your devices using a fingerprint, facial scan, or PIN to sign in.”

Google’s passkey milestones suggest that many people are adopting the sign-in technology, but not everyone is convinced of the rollout’s progress. Despite support for passwords from Microsoft, Apple, Google, and third-party login managers like 1Password and Dashlane, many people have posted about their resistance online, since confusion about the need for access keys for claims about various bugs or issues users met with them.

“Disappointment with technology appears to be the norm rather than the exception,” said William Brown, who runs the blog Firstyear, in a statement. post documenting several of these password problems. “User helplessness on these topics is obvious – and these are early adopters of the technology. The users we need to defend are the advocates of changing passwords to access keys. If these users can’t make this work, how will people in other disciplines fare?”

“Passwords have performed well, we’ve had them for 70 years. We’ve managed to solve most of the problems with passwords, but they still suck, right? Christiaan Brand, identity and security product manager at Google, said On the edge. “The transition path isn’t always easy, and you’ll have a lot of very vocal users who used to do things a very specific way, now all saying that the new thing you’re doing is wrong.”

All of this suggests that the dream of creating a password-free future will have to coexist with more recognized login methods in the near future. “I think as an industry we need to learn a little bit. We’re trying to figure this out and sometimes we make mistakes too,” Brand said. “So we’re making some small adjustments to certain things we’ve done, but ideally we need to go out there and show these early adopter services a path to make a conversion that would make sense.”

Brand says that over time, adding friction to the process of using potentially insecure passwords could promote passkeys as the login of choice. “If you use your password to log into your Google account, that also means you can’t use your password, so you’re either a legitimate user who lost their device or you’re a crook.” Brand gave an example where users who log in using a password instead of their passkey may be asked to wait 24 hours to gain access while Google performs security checks to ensure the account has not been compromised.

In efforts to bolster its security offerings during the upcoming US elections, Google also announced that soon access keys will be supported for your Advanced Protection Program (APP), which offers greater protection to high-profile Google account users such as journalists, activists, politicians and business leaders. APP users will have the option to use access keys alone or together with a password or hardware security key.

Cross-Account Protection, which shares security notifications about suspicious activity on a user’s Google account with connected non-Google apps they use, is also being expanded with “additional collaborations.” Google says this will help better protect billions of users “no matter what platform they are on” by preventing cybercriminals from gaining access to entry points that could expose other user accounts.