Apple to Expand Support for Passwordless Sign-Ins Across Websites and Apps

Apple, Google, and Microsoft today announced plans to expand support for a passwordless sign-in standard created by the FIDO Alliance and the World Wide Web Consortium (W3C), promising a faster, easier, and more secure sign‑in process.

Beyond iPhone 13 Better Blue Face ID
The expanded standards-based capabilities will give websites and apps the ability to offer an end-to-end passwordless sign-in option, according to the announcement. Instead of entering a password, users will sign in through the same action that they take multiple times each day to unlock their devices, such as Face ID on the iPhone.

The new approach is described as "radically more secure" compared to passwords and legacy multi-factor technologies, such as one-time passcodes sent over SMS.

Apple, Google, and Microsoft already support FIDO Alliance standards across their platforms, but expanded support will give users two new capabilities for more seamless and secure passwordless sign-ins, as outlined in the announcement:

1. Allow users to automatically access their FIDO sign-in credentials (referred to by some as a "passkey") on many of their devices, even new ones, without having to reenroll every account.
2. Enable users to use FIDO authentication on their mobile device to sign in to an app or website on a nearby device, regardless of the OS platform or browser they are running.

These new capabilities are expected to become available across Apple, Google, and Microsoft platforms over the coming year, the announcement said.

"Working with the industry to establish new, more secure sign-in methods that offer better protection and eliminate the vulnerabilities of passwords is central to our commitment to building products that offer maximum security and a transparent user experience — all with the goal of keeping users' personal information safe," said Kurt Knight, Apple's Senior Director of Platform Product Marketing, in a press release.

Top Rated Comments

bierdybard Avatar
8 months ago

Can someone explain the security of this? Obviously I doubt that my facial data would be shared with the website, but how does it remain secure?

Would website devs need to drastically change how they code websites or would the phone handle the translation between the website asking for a password and the user just being able to scan their face?
Sure! This happens to be an area of interest for me.

The root of this technology is public-key cryptography. With PKC, there are always two related keys: A private key, and a public key. The public key is easily derived from the private key, but the private key cannot be derived from the public key. The public key can decrypt anything encrypted by the private key and vice-versa, but they cannot decrypt things they themselves encrypt without the other key.

When you are signing up, your local device generates the keys, sends the public key to the service you are accessing (this is effectively your "password", but much more secure), and stores the private key in secure storage (so on an iPhone, the Secure Enclave).

In the future, when you log in, the website sends a challenge, which is just a random string of bytes. You unlock the private key on your local device (for iPhone, using biometrics), and sign the challenge locally. A digital signature is a cryptographic hash of the contents of the message being signed (in this case, the server challenge), which is then encrypted with your private key. When you send the signed challenge back to the server, it uses the public key to decrypt the signature (thus verifying it was you that signed the challenge) and then verifies that the hash of the challenge is correct (thus verifying you signed what the server sent and not some other string of bytes). Since the signature both verifies that 1) your private key is the one that created the signature and 2) the challenge the server sent is the one that was signed, you are securely authenticated without needing to send your secret to the server.

Pretty cool, huh?

Edit: answering the other question: Yes, there are some changes that need to be made to websites to handle this. They need to be able to store the public keys, and they need to be able to handle the challenge and response. The WebAuthn standard handles this for websites, and there are a lot of drop-in libraries for just about any web application stack now.
Score: 41 Votes (Like | Disagree)
kiranmk2 Avatar
8 months ago
Hope this works - even using a password manager is more hassle than it needs to be. The use of biometrics will hopefully also remove the need for 2FA codes.
Score: 17 Votes (Like | Disagree)
zorinlynx Avatar
8 months ago
My main concern with "passwordless" logins is authentication from "first principles".

If you don't have any of your own devices, and want to log into your accounts from a brand new, unknown device, what do you do? I have a couple of critical passwords memorized so that I can get into my stuff if I lose all my devices. These companies seem intent on eliminating all passwords, but at some point you have to have a way to log in if you're starting from scratch.

Conversely, if they do have a mechanism for logging in from scratch, how do they secure it so a bad actor can't pretend to be you logging in from scratch?
Score: 15 Votes (Like | Disagree)
mrbobdobolina Avatar
8 months ago
I have relatives who are very vocal about how much they hate [remembering] passwords. I think this would be a welcome convenience for many people if it works as advertised.
Score: 9 Votes (Like | Disagree)
BootsWalking Avatar
8 months ago
For those asking how this works, here's a simplified explanation based on my understanding from reading and watching the online resources about it.

To register on a new site, say widget.com
[LIST=1]
* You go widget.com and navigate to its new-account creation page
* Type in what you want your username to be and then click "create account"
* Your phone will bring up a system sheet confirming you want to create a credential for widget.com. After you confirm, the phone will create a site-specific credential token (called "passkey" in FIDO parlance), the security of which is based on public-key encryption.
* The phone will store the token and private-key portion of the token on your iCloud Keychain. It will share the public-key portion of the token with widget.com so it can save it on their server.

Whenever you visit widget.com in the future, Safari will know you have a saved credential for the site and will confirm you'd like to login, similar to how it works today for traditional passwords saved in your keychain, including you proving you have rightful access to your keychain (Face ID, passkey, etc...). But instead of a password, Safari will present the passkey (token) to the site (which it already has stored on their server to compare), then verify you're the rightful owner of the token by proving to the site that your phone has the private key associated with the token (challenge/response).
Score: 7 Votes (Like | Disagree)
bierdybard Avatar
8 months ago

As a developer, what do I need to do to support this? How does this actually work?

Based on reading Apple's full press release, it sounds to me like this is just:
1 - Your device automatically generates a password when an account is created, the same as Safari can already do.
2 - Your device automatically fills in the password when it's requested, the same as all browsers can already do.
3 - Your devices will automatically sync these passwords with each other, possibly with more interoperability between brands, so, ie, Windows and Linux and Mac and iOS and Android will all implement the same standards so everything will be more seamless when mixing different types of devices together.
4 - The automatic password stuff is all handled in the background, without any UI needing to be involved, so the end user won't ever see a text field that gets populated automatically for them. So from the perspective of a web developer, not much will change. IDK - will this just make it so that input fields of type password and type hidden are rendered the exact same (which is to say, not at all?)
Except it's not passwords, it's public-key cryptography.

If you're running a service, you need to set up the service to handle WebAuthn, or whatever this extended standard will be called.

If you're building a client, you'll need to implement whatever APIs are necessary to do the client-side portion of the authentication. This is what the FIDO standard covers, but again, not sure what the APIs will look like outside of the web browser (again, WebAuthn).

So no, it's not zero-effort, but it is infinitely more secure than either passwords or TOTP (numeric one-time passwords) because the secret never leaves the device. In this scheme, the server only needs the public key, which is not the secret.
Score: 7 Votes (Like | Disagree)

Related Stories

1password passkeys

1Password Will Support Passkeys Starting in Early 2023

Thursday November 17, 2022 7:45 am PST by
Popular password management service 1Password today confirmed that it will begin supporting passkeys in early 2023, allowing users to sign in to supported websites and apps without a password. Instead, biometric authentication on trusted devices is used to confirm your identity, and removing passwords from the equation means they can not be compromised or phished. Apple rolled out support...
paypal passkey

PayPal Announces Support for Safari Passkeys Feature

Monday October 24, 2022 9:21 am PDT by
Popular payments service PayPal today announced that it is introducing support for passkeys, providing an easier and more secure login method for PayPal accounts. Apple integrated passkeys into iOS with the launch of iOS 16, and it is also available in iPadOS 16.1 and macOS Ventura, coming today. Passkeys are an industry standard developed by the FIDO Alliance and the World Wide Web...
Apple vs Microsoft feature

Microsoft Considering Building All-In-One App for Search, Shopping, Messaging, and More

Tuesday December 6, 2022 6:41 am PST by
Microsoft is looking to build a "super app" that incorporates a messaging platform, shopping, web search, and news into a single app, an apparent attempt to go after Apple and Google's app store platforms. According to a report today by The Information, Microsoft has been in the early stages of building a "super app" at the direction of the company's CEO Satya Nadella. Nadella has reportedly ...
plex

Plex Asks Users to Reset Passwords Following Data Breach

Wednesday August 24, 2022 2:03 am PDT by
Popular media platform Plex has asked users to change their passwords "out of an abundance of caution" after it found a third-party had gained access to one of its internal systems. In a message to all users, Plex said that after discovering "suspicious activity" on one of its databases on Tuesday, the company ascertained that a hacker had been able to access "a limited subset of data"...
iOS 16

Apple Stops Signing iOS 16.1 and iOS 16.1.1 Following iOS 16.1.2 Launch

Wednesday December 7, 2022 5:27 pm PST by
Following the launch of iOS 16.1.2 on November 30, Apple has stopped signing iOS 16.1.1 and iOS 16.1, two previously available versions of iOS.. With iOS 16.1 and iOS 16.1.1 no longer being signed, it is not possible to downgrade to those versions of iOS after upgrading to iOS 16.1.2. Apple routinely stops signing older versions of software updates after new releases come out in order to...
1password apple watch

1Password 8 for Apple Watch Released With New Features and Complications

Thursday October 13, 2022 2:09 am PDT by
AgileBits has announced the release of 1Password 8 for Apple Watch, a natural extension to its iOS app that completes the rollout of the new version of its multi-platform password manager. 1Password on Apple Watch gives users customizable access to "nearly anything" in their 1Password account, even when they don't have their iPhone or an internet connection, according to the developers. The...
swiftkeyios

Microsoft Brings Back SwiftKey for iOS, Teases New Features Coming Soon

Saturday November 19, 2022 12:11 am PST by
Microsoft's popular third-party keyboard for iOS, SwiftKey, is back on the App Store just weeks after the company announced it would be shutting down the app and delisting it from the platform. In September, Microsoft said SwiftKey for iOS was being shut down and removed from the App Store for no clear reason. SwiftKey has been a popular alternative for iPhone users to Apple's default iOS...
Apple advanced security iMessage Contact Key Verification screen Feature

Apple Previews New iMessage and Apple ID Security Features Coming in 2023

Wednesday December 7, 2022 10:00 am PST by
In addition to expanding end-to-end encryption to many additional iCloud data categories on an optional basis, Apple today also announced two other new security features designed to protect against threats to user data in the cloud. iMessage Contact Key Verification Apple says the new iMessage Contact Key Verification and Security Keys for Apple ID features will be available globally on the...

Popular Stories

Apple advanced security Advanced Data Protection screen Feature

FBI Calls End-to-End Encryption 'Deeply Concerning' as Privacy Groups Hail Apple's Advanced Data Protection as a Victory for Users

Thursday December 8, 2022 2:45 am PST by
Apple yesterday announced that end-to-end encryption is coming to even more sensitive types of iCloud data, including device backups, messages, photos, and more, meeting the longstanding demand of both users and privacy groups who have rallied for the company to take the significant step forward in user privacy. iCloud end-to-end encryption, or what Apple calls "Advanced Data Protection,"...
General iOS 16 Feature Yellow

iOS 16.2 for iPhone Expected to Launch Next Week With These 12 New Features

Thursday December 8, 2022 7:05 am PST by
iOS 16.2 is expected to be released next week following nearly two months of beta testing. With last-minute additions like Apple Music Sing and Advanced Data Protection, the software update now has over a dozen new features for the iPhone. Below, we've recapped many of the new features coming with iOS 16.2, including Apple's new whiteboard app Freeform, two new Lock Screen widgets, the...
maxresdefault

Can't Get an iPhone 14 Pro? Here's Why You Should Wait for the iPhone 15 Ultra

Monday December 5, 2022 11:44 am PST by
Due to production issues at Apple supplier factories in China, the iPhone 14 Pro and iPhone 14 Pro Max are backordered and basically out of stock at every store. If you were planning to gift or receive an iPhone 14 Pro model for the holidays and didn't already get one, you're basically out of luck because they're gone until late December. Subscribe to the MacRumors YouTube channel for more ...
maxresdefault

Hands-On With Apple Music Sing in iOS 16.2

Wednesday December 7, 2022 12:24 pm PST by
With the iOS 16.2 release candidate that came out today, Apple added the new Apple Music Sing feature that was announced earlier this week. We thought we'd check out the new karaoke feature to see how it works. Subscribe to the MacRumors YouTube channel for more videos. Apple Music Sing is available on modern iPhones and iPads, as well as the newest Apple TV 4K. It's built in to the Apple...
General iOS 16 Feature Yellow

iOS 16.2 for iPhone Launching This Month With These 8 New Features

Thursday December 1, 2022 8:44 am PST by
Apple plans to publicly release iOS 16.2 for the iPhone in mid-December, according to Bloomberg's Mark Gurman. The update remains in beta testing for now, with at least eight new features and changes already uncovered so far. iOS 16.2 introduces a number of new features, including Apple's new whiteboard app Freeform, two new Lock Screen widgets for Sleep and Medications, the ability to hide...
Apple Accessories Deals 2022 Anker

Deals: Amazon's New Anker Sale Has Savings on USB-C Chargers, Portable Batteries, and More

Wednesday December 7, 2022 8:10 am PST by
Anker this week has introduced a new sale across its most popular accessories on Amazon, including savings on USB-C cables, wall chargers, portable batteries, wireless chargers, and more. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Many of these sales...
Apple advanced security Advanced Data Protection screen Feature

Apple Announces End-to-End Encryption Option for iCloud Photos, Notes, Backups, and More

Wednesday December 7, 2022 10:00 am PST by
Apple today announced it is expanding end-to-end encryption to many additional iCloud data categories on an opt-in basis for enhanced security. iCloud already protects 14 data categories using end-to-end encryption by default, including the Messages app when backups are disabled, passwords stored in iCloud Keychain, Health data, Apple Maps search history, Apple Card transactions, and more,...
Twitter Feature

Twitter to Charge $11 Per Month for Twitter Blue on iPhone, $7 on Website

Wednesday December 7, 2022 6:47 pm PST by
Twitter plans to charge $11 per month for a Twitter Blue subscription on the iPhone in order to account for the 30 percent cut that Apple takes from in-app purchases, reports The Information. On the web, Twitter Blue will be priced at $7 per month. Prior to when Twitter Blue was paused, Twitter was charging $7.99 for a subscription, but the pricing will change before it relaunches. According ...
Apple car wheel icon feature yellow

Apple to Charge Under $100,000 for Apple Car, Launch Planned for 2026

Tuesday December 6, 2022 2:31 pm PST by
Apple is aiming to launch an Apple-branded consumer-oriented vehicle by 2026, and its goal is to hit a price point under $100,000 to make the car appeal to a wider range of customers, reports Bloomberg. Apple initially planned to design a car that might look similar to Canoo's Lifestyle Vehicle, where passengers could face one another in a limousine-style car with no steering wheel or...