On World Password Day, Apple, Google, and Microsoft teamed up to expand support for a passwordless sign-in standard built by the FIDO Alliance and the World Wide Web Consortium. The parties and the Cybersecurity and Infrastructure Security Agency (CISA) called this move a “milestone” on the passwordless journey.

FIDO argues that password-only authentication is one of the biggest security issues on the web, leading to customer frustration, account takeovers, data breaches, and stolen identities.

“Passwords are one of the industry’s greatest and most pervasive security vulnerabilities and most intractable problems,” Beyond Identity CMO Patrick McBride told SDxCentral. “Efforts like FIDO are critical as they endeavor to address different use cases to try and start to move away from password dependence.”

The passwordless standard-based capabilities allow users to sign in through the same actions as unlocking their devices via biometric verification or a device PIN. FIDO claims this approach is more secure than traditional passwords or legacy multi-factor technologies using one-time, text message passcodes.

Google, Microsoft, and Apple have already adopted some FIDO Alliance standards to move toward passwordless sign in, which require customers to sign in to each device, website, or application before using passwordless functionality.

The expanded support improves that user experience by automatically allowing FIDO sign-in credential – often referred to as "passkey" – access for multiple devices without the need to re-enroll, and it also enables the use of FIDO authentication on mobile devices for application or website sign in on other nearby devices.

The move also enables service providers to offer passwordless FIDO credentials as alternative sign in or account recovery methods. The three tech giants expect to offer those capabilities across their platforms by next year.

“Today is an important milestone in the security journey to encourage built-in security best practices and help us move beyond passwords,” CISA Jen Easterly noted in a statement.

Google cited support for FIDO sign-in standards in Android and Chrome as a milestone of the company's decade of work on passwordless innovations, which includes two-step verification, Google password manager, its Advanced Protection Program, and built-in security for mobile.

“For the first time this will make it possible for websites to implement an end-to-end passwordless experience with phishing-resistant security,” a Google spokesperson wrote in response to questions. “When passkey support becomes available across the industry in 2022 and 2023, we’ll finally have the internet platform for a truly passwordless future.”