Google’s passkey gamble: a cage built for android users

Google is quietly attempting to force android users into a passkey-based system, a move that’s already drawing criticism for its lack of portability and a frustratingly restrictive rollout.

The slow rollout of passkey support

Reports are emerging that Google is testing a built-in feature within its Password Manager on android, allowing users to import and export passkeys – a welcome step for a platform that’s been lagging behind iOS in this crucial security area. However, the implementation is currently limited, requiring users to navigate through settings to access these functionalities, and crucially, only supporting password managers that embrace the Credential Exchange Protocol (CXP).

Apple took the lead – months ago

This isn’t groundbreaking technology. The groundwork for this functionality was laid back in 2023 when the FIDO Alliance championed a universal passkey system. What’s astonishing is that Apple, notoriously protective of its ecosystem, shipped this capability to iOS and macOS users months ago. iPhone users have been seamlessly migrating their passkeys to Bitwarden, 1Password, and other CXP-compatible managers with ease – a freedom android users are now denied.

A lock-in risk

The current system on Android forces users to delete their passkeys if they choose to switch away from Google Password Manager. This isn’t portability; it’s a carefully constructed digital cage, designed to maintain user dependence. It’s a fundamental contradiction for a company that helped create the passkey standard in the first place.

What's really at stake?

Passkeys are positioned as the future of logins, offering phishing resistance and eliminating the vulnerability of reused passwords. Yet, Google’s delayed implementation raises serious questions about the vision. Until this feature is publicly released and the compatibility list expands, users remain stuck with the limitations of the current system. The fact that Google is playing catch-up, after Apple pioneered this crucial advancement, suggests a fundamental misstep in their approach to digital security. This won’t be fixed by simply flipping a switch; it necessitates a shift in thinking about user autonomy and data ownership. It’s a crucial test of whether Google truly believes in the promise of passkeys, or if it’s merely leveraging the technology to solidify its control over the Android ecosystem.