Come-on Passkeys

In a stark warning against the rising tide of AI-fueled cyberattacks, Google is pushing Gmail users to abandon traditional passwords and two-factor authentication (2FA) in favor of passkeys. This move comes as threat actors increasingly find ways to bypass or steal 2FA codes, exposing critical vulnerabilities in online security.

​

The call to action coincides with Microsoft's recent announcement of its intent to migrate its vast user base to passkeys, effectively rendering passwords and 2FA obsolete. However, Microsoft has also emphasized a crucial step: simply creating a passkey is not enough. Users must also delete their passwords to close potential security loopholes. Google acknowledges this critical point.

While Google began rolling out passkeys in 2023, heralding it as the "end of the password," the company has maintained that passwords will remain necessary for devices that don't yet support passkeys. However, Google has signaled a shift in focus, stating that creating a passkey allows users to "pay closer attention to the sign-ins that fall back to passwords." Over time, as passkeys gain wider adoption, these fallback logins will be increasingly scrutinized.

Recent 2FA bypass attacks have accelerated the urgency for change. While Google is implementing QR codes to address network 2FA vulnerabilities, security experts argue this doesn't tackle the core issue. Instead, users are strongly advised to prioritize setting up passkeys on all accounts that support them, including Gmail.

"When you do set up your passkey, change your password for something horribly long, complex and unique, and add the strongest 2FA method you can," advises security analysts. "You won’t use it often, so it doesn’t have to be convenient. Clearly don’t use SMS unless you have no choice."

Experts are calling for Google and Microsoft to accelerate the transition to passkeys, advocating for deadlines, incentives, and disincentives to encourage adoption. They also emphasize that any improvements to 2FA should be framed within a broader passkey campaign, ensuring it remains a fallback option, not a primary login method.

Ep308

Image created by AI