Google has finally added support on their accounts for a game-changing new
technology that we will all be using very soon to make our lives easier,
and it's called passkeys. And passkeys are the result of an effort from all the major
tech companies to replace the use of passwords for logging into accounts.
And I don't mean just a new two-factor authentication method, but rather completely
replacing passwords altogether. They're easier to use than remembering passwords,
and they're theoretically phishing-proof. And in some cases on some websites,
it means you don't even necessarily have to remember a username either.
So what I'll do is explain what exactly these passkeys are, and show you how to
set them up on your Google account right now, and I'll explain using both iOS and Android,
and even Windows. So what exactly are passkeys though? Basically it makes it so instead of typing
in a password to log into your account, you scan a QR code using your phone to confirm the login.
Now you might be thinking, wait, how is that special? And how is that any better
than existing two-factor authentication methods for logging in in terms of security? And what
happens if someone steals that code, or tricks someone into scanning the code for them, like
they do with tricking people into handing over two-factor authentication codes and stuff already?
Plus on top of all that, what if you lose your phone? Well actually, passkeys have all
of those issues covered. That's right, even if a scammer is trying to break into someone's account,
and they see that code pop up, and they are able to send that code to the victim,
and even trick them into scanning the code with their phone, the scammer will
still not be able to log into the account, even though the person scanned the code.
It's definitely an interesting technology you'll want to know
about. So first let me give you a bit more context on how these passkeys work,
and explain how they're different from existing methods of login. Basically at its core,
a passkey is just a so-called private key. And every website you sign up for,
and actually every account on every website, will get its own private key, and therefore a passkey.
I don't want to spend the whole video explaining how public key cryptography works,
but just know that when you go to create a passkey, it effectively creates a private key,
and that is stored on your secure element on your phone. But the website also gets
a public version of the key that lets the website verify that you have the private
key when you try to log in, without actually ever knowing the private key.
So after creating a passkey, the next time you go to sign into a website, the website will
display a QR code, which is basically a test that basically says, "Here's a question that
only the person with the private half of this key for this account can answer." Then when it
displays the code and you scan it with your phone, your phone uses the private key it has stored to
answer the question, but again, not actually giving the website the private key itself.
Once the website verifies that you're the holder of that private key and you're authorized,
then it logs you in on that original device. But here's the important
bit. Before your phone will answer that test question for the website,
it requires that you're connected to that device trying to log in via Bluetooth.
Meaning that your phone with the passkey must be physically near the computer or
device that's trying to log in. But don't worry, it does not require going into the
settings and connecting to the device via Bluetooth or setting anything up.
It's all completely automatic and in the background, even the first time you do it.
Anyway, like I said, this means that unlike most two-factor authentication methods, where a scammer
could trick someone into giving them the login code or accepting a login prompt on their phone,
in this case, even if a scammer tricks someone into scanning the login code with their phone,
that phone will not be able to connect to the scammer's computer via Bluetooth
and therefore the scammer won't be able to log in either way.
Now, some of you clever people might be thinking, "Wait a minute,
passkeys sound like just one factor to log in. How is that more secure than using a
password and a second factor?" But actually, technically passkeys are still two-factor.
It's just that they use your phone's lock screen login method as the second factor.
And that's another point. To set up and use a passkey, your phone must
have some kind of lock screen pin or Face ID or fingerprint or whatever. And to be clear,
it will prompt that verification even if your phone is already unlocked. So if
someone grabs the phone away from you that's unlocked and tries to log into an account,
they won't be able to do it because they won't know your pin or fingerprint or whatever.
And also if someone steals your phone, they won't be able to get into the phone
and unlock it in the first place and therefore still won't be able to access your accounts.
Another concern might be what if you lose your phone, but both Apple and Google have
cloud backups of passkeys via the Google Password Manager or Apple iCloud Keychain.
And in both cases, they're end-to-end encrypted. So neither Google nor Apple
will be able to see your actual private keys, even though they're backing them
up because the encryption occurs on your phone using your local pin. So the simple
answer is even if you lose your only phone, if you go to get a new phone,
you'll still be able to sync the passkeys from the cloud onto that new one.
And then you simply decrypt it using the pin from your previous phone. Now obviously without the
original phone, you won't be able to log into the account on the new phone using a passkey.
So that probably means you still will need to have a password as a fallback method of login
just so you can actually attach the new phone to the account to actually start the sync.
Now one more cool thing is because each individual account on a website will get its own passkey,
then that means you technically don't even need to remember your username for that
account. Because you'll simply be able to select the passkey,
which will have the account name associated with it probably.
You just select it and it'll log you in. Now this will depend on whether the website
will still make you put in a username or not. For example with a Google account,
you still need to put in your email address to log in. Anyway,
now that you have a general idea of how passkeys work, I can show you the setup
process for a Google account and it'll be a similar process for most other websites.
And again, I'll demonstrate using a iPhone, Android, and Windows device using like Windows
Hello. And you can actually have multiple of these methods per individual account,
assuming the website supports that. So to set up a passkey on your Google account,
you first need to go into the settings and then the security settings screen.
And you'll see under the add more sign in options, you can select passkeys. If you already have some
physical security keys setup, these will show here too for some reason, but just click create
a passkey. And like I said, you can actually add more even if you already have a passkey setup.
If you have Windows Hello set up on your computer, clicking continue by default will use that method.
So I'll just do that first, and then I'll show you how to do iOS and Android next. Anyway, it'll have
you confirm the Windows Hello prompt and then it's set up. That's literally it. There's no QR code or
anything in this case because it's on the same device. And when you do use Windows Hello, it
will store the private key for the passkey in your TPM module on your computer, assuming it has one.
So it still is secure. And also another thing is with Windows Hello, that's not actually syncable.
That's only going to work on that individual computer where you set up that passkey. But that
also means that you don't have to scan any codes or anything if you're logging in from that one.
Now, if you're going to set up using a phone, instead you would click "Use Another Device."
And then at the moment, Chrome will pop up a thing looking like this,
where you select "Use a Phone or Tablet". And then it'll show you a setup QR code for the
passkey that I'm going to obviously block out. First, I'll try it on iPhone. And all you do
is open up the camera app and point it at the code and click where it says "Save a Passkey."
And then it'll ask you to confirm with Face ID or fingerprint,
whatever you have. And once you scan and confirm it on the browser,
it will automatically finish. And then you can now log in with that passkey. And I'll show the
login process right after I show you the Android setup process. With Android, it's very similar.
Once the setup code comes up, you scan it again with the camera and a thing will say
"Use Passkey", though it might look slightly different depending on your phone. Then it'll
say connecting to device, and it might ask you if Chrome can connect to nearby devices,
which again is using Bluetooth. Next, it displays which account you're creating the passkey for.
And below, it'll show which Google accounts password manager it will be stored in. And
you can change that if you want. Then for me, it asked if I want to use lock screen for encryption,
though this might not come up if you've been asked this before by your phone. So do notice in the
background, it says "something went wrong" because I was taking too long while doing the recording.
So even though it says registration succeeded, it didn't really. And I did have to scan it again,
but most cases, it'll say registration succeeded, and then you can log in with it. And now I have
three different passkeys I can demonstrate the login process for. So I logged out of the Google
account, and it does require you to still type in your email address when you want to log in.
But after you do, assuming you have passkeys set up by default, that will be the default
thing it'll ask you to do. When I hit continue, it defaults to Windows Hello local login. So I used
my fingerprint thing, which I used to log into Hello. And boom, instantly logged on. If I instead
hit "Try Another Way", then it'll ask you if you want to use a password or a different passkey.
So I'll hit "Use a Phone or Tablet", and it'll pop up another QR code,
this one for signing in. Then I can go to my iPhone and scan it with the camera. This time
it says "Sign In With Passkey". Then it says connecting, which in the background
is connecting to my computer via Bluetooth. And then it asks me to confirm using Face ID.
And once it does that, on the computer, I get logged in automatically. Now let's try
for Android. So I scan the code and hit "Use Passkey". And this screen is blacked out,
but it's just asking me for my fingerprint. After that,
again it says connecting and processing, and then it logs me in on the computer.
And I can demonstrate what happens if you have Bluetooth disabled. So I'll turn that off. And
when you go to sign in, it will ask you to turn on Bluetooth. If you deny it, it'll just kick you
back to the camera. So you do have to have Bluetooth enabled, like I said. So anyway,
now no matter what kind of phone you have, you can set up passkeys on your Google account.
As for other websites that support logging in, it's extremely limited right now. But I
think now that Google added it, a lot of other companies will kind of notice it and hopefully
adopt it more. It's definitely something you'll want to be setting up whenever you
have the chance. Anyway, hopefully you found this video interesting.
And if you didn't know about passkeys before, let me know down in the comments. Are you going
to start using this whenever you can? I think you should. And if you did enjoy this video,
be sure to give it a giant thumbs up for my YouTube algorithm overlords. Now,
speaking of security, if you want to keep watching, the next video I'd recommend is
where I was talking about some malicious Chrome extensions and how you still
have to worry about those, not just computer malware and stuff.
So I'll put that link right there. Thanks so much for watching, and I'll see you in the next one.