IT Security is an ever-evolving field – or a game of cat-and-mouse, if you'd rather – with either new or improved standards to make sure we keep our data safe. One of the more recent developments has been the FIDO2 initiative, which promises secure access to websites and applications without the strict need for passwords. And one of the announcements coming out of MWC this year is that Android is now FIDO2-certified.
With FIDO2, security is handed off to alternate devices like fingerprint readers, cameras, and FIDO keys for any site or app that supports the protocol. Ideally, this could mean that you don't have to enter your password as often to login to your favorite services, assuming the developers bake in support for the FIDO2 API. The appeal of this comes from its purported strength against phishing, man-in-the-middle, and stolen credential attacks.
Android devices will either support FIDO2 right out of the box or with a Google Play Services update. It'll be up to individual manufacturers to take advantage of the out-of-the-box certification, from the sounds of it.
PRESS RELEASE
BARCELONA, February 25, 2019 — FIDO Alliance announced today that Android is now FIDO2 Certified, bringing simpler, stronger authentication capabilities to over a billion devices that use this platform every day. With this news, any compatible device running Android 7.0+ is now FIDO2 Certified out of the box or after an automated Google Play Services update. This gives users the ability to leverage their device’s built-in fingerprint sensor and/or FIDO security keys for secure passwordless access to websites and native applications that support the FIDO2 protocols.
Web and app developers can now add FIDO strong authentication to their Android apps and websites through a simple API call, to bring passwordless, phishing-resistant security to a rapidly expanding base of end users who already have leading Android devices and/or will upgrade to new devices in the future.
“Google has long worked with the FIDO Alliance and W3C to standardize FIDO2 protocols, which give any application the ability to move beyond password authentication while offering protection against phishing attacks. Today’s announcement of FIDO2 certification for Android helps move this initiative forward, giving our partners and developers a standardized way to access secure keystores across devices, both in market already as well as forthcoming models, in order to build convenient biometric controls for users,” said Christiaan Brand, Product Manager, Google.
Already supported in market by leading web browsers Google Chrome, Microsoft Edge, and Mozilla Firefox (with preview support by Apple Safari), FIDO2 is comprised of the World Wide Web Consortium’s (W3C) Web Authentication specification and the corresponding Client to Authenticator Protocol (CTAP) from FIDO Alliance. Collectively, these standards enable users to more easily and securely login to online services with FIDO2-compliant devices such as fingerprint readers, cameras and/or FIDO security keys.
“FIDO2 was designed from day-one to be implemented by platforms, with the ultimate goal of ubiquity across all the web browsers, devices and services we use every day. With this news from Google, the number of users with FIDO Authentication capabilities has grown dramatically and decisively. Together with the leading web browsers that are already FIDO2 compliant, now is the time for website developers to free their users from the risk and hassle of passwords and integrate FIDO Authentication today,” added Brett McDowell, Executive Director, FIDO Alliance.
FIDO2’s simple user experiences are backed by strong cryptographic security that is transparent to the user and protects against phishing, man-in-the-middle and attacks using stolen credentials. FIDO2 support has been growing since the specifications were introduced last spring. In addition to browser and platform support, several FIDO2 Certified products have been announced to support implementation.
Device manufacturers interested in taking advantage of out-of-the-box certification and displaying the FIDO Certified logo on their Android devices should consult FIDO Alliance’s new trademark and service mark usage agreement.
Source: FIDO Alliance
