Google goes password-less for some web services through Android, more to come

Google today announced that it is bringing the ability to use your fingerprint or other authentication methods instead of your password, on its own services. The feature will be available today to users on Pixel devices and will roll out to all devices running Android 7 Nougat or higher in the coming days.

The feature is based on the FIDO2 standards W3C WebAuthn and FIDO CTAP (Client-to-Authenticator Protocol) which enable the usage of biometrics on the web. The company says that this is the reason why FIDO2 was beneficial over the native fingerprint API on Android. Currently, the feature is enabled for Pixel users only on the Google Password Manager service (passwords.google.com). The service prompts for a one-time enrollment to register the user’s fingerprint, after which logging into the service happens directly through the fingerprint/pattern unlock. This way of logging in is easier and faster than the traditional way of typing in a password.

The firm adds that users’ fingerprint or other information is never sent to the server. The information is stored securely in the device itself and only a “cryptographic” proof of the authenticity of your identity is sent to the service, something that the firm calls a “fundamental part of the FIDO2 design”. The service works for those that have enabled two-step verification as well.

Google says that the ability to login with alternative methods of authentication will make it to more Google and Google Cloud services soon. The company envisions to bring this feature to more Google services and other third-party services that can tie in with your Google account through the web both, on mobile as well as desktops.

It is not the first time that a company has enabled biometric authentication on the web. Microsoft showed off back in 2016 how authentication on websites could be done through Windows Hello. Apple too is pushing towards reducing password usage through the way of ‘Sign in with Apple’.

It is interesting to see if more services and websites go the way of password-less sign-in since passwords are susceptible to breaches and not everyone uses complex passwords. For now, though, Pixel users can head to passwords.google.com through Chrome to try out the feature.