A world without passwords would be more convenient and would make switching between iOS and Android more difficult

     On the morning of May 31, on World Password Day in early May, the security agency FIDO received new support from Apple, Google, and Microsoft, and these major technology companies announced that they are expanding their support for password-free login standards. Users may no longer have to enter passwords, but some people are worried that a world without passwords may further lock users into the Apple and Google ecosystems.

　　Ben Lovejoy, an author of foreign media 9to5mac, discussed this matter.

“A world without passwords”

　　A world without passwords is the mission of the FIDO Alliance (Fast IDentity Online).

　　Currently, to log into a website or app, we usually enter our username and password. Passwords have been a terrible form of security for years — and become even more so with every additional service we use. Security questions, as a crude form of authentication, are also a mess.

　　What FIDO does is allow our devices to authenticate users. Taking the iPhone that supports face recognition as an example, the logic is as follows:

　　The website or app asks you to identify and prove your identity.

　　Your iPhone will receive the request and activate Face ID.

　　If the faces match, the iPhone tells the website who you are and allows entry.

　　There are no passwords involved: Authentication is performed on the device, not on the website server. The web server trusts the user's iPhone, a bit like a payment terminal trusts the phone so that Apple Pay transactions don't require a password.

　　As early as 2019, Apple tried this approach and began to support the FIDO standard. Other technology giants have also begun to support it, such as Amazon, Arm, Facebook, Google, Intel, Microsoft and Samsung. FIDO board members include financial institutions such as American Express, ING, Mastercard, PayPal, Visa and Wells Fargo.

　　Device-to-device authentication does remove the need for a password. However, there is currently no mention of switching between ecosystems in the standard. The key is stored on the user's device, which could be a bit problematic if you want to switch from an iPhone to an Android phone, or vice versa.

　　FIDO's current solution does not have a mechanism for bulk transfer of keys between ecosystems. If you want to switch from an Android phone to an iPhone (or vice versa), you can't move all your keys. Passwords, by contrast, are much easier to transfer.

　　“We don’t really have a bulk export method right now,” said Andrew Shikiar, executive director of the FIDO Alliance. “I think that could be a future iteration.”

　　In theory, this is an easy problem to solve: just allow passwords to be exported and imported in the same way as passwords are today. But given that FIDO is meant to be more secure than passwords, the alliance is reluctant to allow this. If users can easily import/export all their keys between devices, hackers could potentially exploit this feature.

　　This limits users to the current ecosystem and makes it difficult for them to switch systems.