Apple, Google and Microsoft have announced that they are joining forces to support a common passwordless sign-in standard that will allow websites and apps to offer consistent, secure and easy sign-ins across devices and platforms.

The Problem With Password-Only  

Relying on password-only authentication is known to present many risks and challenges such as managing multiple passwords being cumbersome for users leading to password-sharing, data breaches, and stolen identities. Despite the added measure of two-factor authentication, the goal of tech companies in recent years has been to create sign-in technology that is more convenient and more secure and move towards a passwordless future.

FIDO Alliance & W3C Standard 

The new common passwordless sign-in standard that Apple, Google and Microsoft are joining forces to promote and introduce is an expanded standard created by the FIDO Alliance and the World Wide Web Consortium.

Two New Capabilities For Users 

Although Apple, Google and Microsoft already support FIDO Alliance standards to enable passwordless sign-in on billions of devices, previous implementations have required users to sign-in to each website or app with each device before they can use the passwordless functionality. This latest announcement, therefore, is really about how the platform implementations have now been extended to give users two new capabilities for more seamless, secure passwordless sign-ins. These new capabilities are:

1. Users can now automatically access their FIDO sign-in credentials (also known as a “passkey”) on many of their devices, even new ones, without having to re-enrol every account.

2. Users can employ the FIDO authentication on their mobile device to sign-in to an app or website on a nearby device, regardless of the OS platform or browser.

This means that, as well as being easier and more convenient, if widely supported, service providers could also offer FIDO credentials without needing passwords as an alternative sign-in or account recovery method.

Follows A Decade Of Work 

Mark Risher, Senior Director of Product Management for Google said, “For Google, it represents nearly a decade of work we’ve done alongside FIDO, as part of our continued innovation towards a passwordless future. We look forward to making FIDO-based technology available across Chrome, ChromeOS, Android and other platforms, and encourage app and website developers to adopt it, so people around the world can safely move away from the risk and hassle of passwords”. 

Talking about the standard’s contribution to the vision of a passwordless future, Alex Simons, Corporate Vice President, Identity Program Management at Microsoft said, “By working together as a community across platforms, we can at last achieve this vision and make significant progress toward eliminating passwords”.   

Andrew Shikiar, executive director and CMO of the FIDO Alliance highlighted how the standard could help service providers, saying “This new capability stands to usher in a new wave of low-friction FIDO implementations alongside the ongoing and growing utilisation of security keys — giving service providers a full range of options for deploying modern, phishing-resistant authentication”. 

What Does This Mean For Your Business? 

Finding solutions to keep one significant step ahead of cybercriminals whilst maintaining or increasing convenience for users, and avoiding the damage caused by data breaches, is an ongoing challenge for the tech companies. The passwordless future is the vision that’s starting to see some progress. 2FA has provided just enough security for now and biometrics were touted as the way ahead. Expanding the FIDO Alliance standards is the next “low-friction” step along the way and the weight of Apple, Google and Microsoft publicly getting behind it should mean that it is more widely adopted, thereby hastening the journey towards the realisation of the ‘passwordless’ vision. Cybercriminals, however, are always pushing and finding new ways to beat security systems, and with the threat of AI being used in the wrong way soon, it remains to be seen how successful the widespread use of the expanded FIDO Alliance standards will be in the near future.

The UK government has announced that it is giving statutory powers to the new Digital Markets Unit (DMU) regulator to enforce pro-competition rules and protect users from the “unfair practices” of big tech companies.

New Watchdog To Prevent Abuse of Market Power 

Following a consultation in July 2021, the government says that it is giving statutory powers to its new DMU tech watchdog, launched in non-statutory form within the Competition and Markets Authority (CMA) last year, to make sure tech companies don’t abuse their market power.

Armed with its new powers, the DMU will be able to enforce new tailored codes of conduct for how the handful of firms dominating digital markets should treat their users and other companies fairly. Sanctions for those companies who ignore the new rules could include a fine of up to 10 per cent of their global turnover.

The government says that the DMUs job will be:

– To help boost competition across digital markets by tackling the harmful effects and sources of substantial and entrenched market power.

– To protect smaller businesses from predatory practices and to protect consumers and competition by governing the relationship between users and key ‘gateway’ digital firms.

– To ensure fair prices for content in disputes between powerful platforms and content providers such as news publishers and advertisers. As part of this role, the DMU will have the power to step in to solve pricing disputes between news outlets and platforms. Also, the DMU could help ensure that app developers can sell their apps on fairer and more transparent terms.

– To make it easier for people to switch between Apple iOS and Android phone operating systems or between social media accounts without losing their data and messages. The DMU, for example, will be able to stop companies limiting consumers to pre-installed software on their devices. This could also give users more choice of which search engines they have access to, and of social media platforms as new entrants enter the market, as well as giving more control over how their data is used by companies.

– To make sure that smaller firms are alerted to any algorithm changes which affect the driving traffic and revenues.

Those With ‘Strategic Market’ Status To Report Takeovers 

The government also says that a small number of companies with substantial and entrenched market power will be designated with ‘strategic market’ status and will have to report takeovers before they complete so the CMA can conduct an initial assessment of the merger to determine whether further investigation is needed.

Should Mean Greater Choice and Lower Prices For Consumers 

Consumer Minister, Paul Scully, said that with the new powers for the DMU: “We’re ensuring our modern, digitised economy gives consumers better products, greater choice and lower prices by having companies compete for customers on a level playing field”. 

What Does This Mean For Your Business?

It would be difficult to deny that there are essentially just a handful of big gateway tech companies that are entrenched, and able to exert a lot of control over the market with their power. The move with the consultation and the threat to give the DMU statutory powers (which may not actually happen) is an attempt to try and create a more favourable competitive environment where smaller entrants have more of a chance and aren’t simply bought up before they become a threat, where end users have more choice, and where big tech firms are less able to charge higher prices because they can. This move by the UK government is also part of a wider strategy to hold big tech companies to account in many ways, including improving safety, e.g. with the Online Safety Bill. The announcement about possible powers for the DMU is also likely to be good news for publishers, advertisers and app developers. For the big tech companies, it is likely to be preferable to avoid too much more external scrutiny and regulation than they already have, so this latest announcement and its implications for profits is likely to be unwelcome news for them.