THE EVOLUTION OF FIDO EXPERIENCES ON ANDROID

Summary from the TLDR InfoSec newsletter

Google detailed Android's evolution from password-based authentication to FIDO2 passkeys, starting with Universal Second Factor (U2F) in 2014 as a phishing-resistant second factor and advancing to passwordless passkeys built on WebAuthn and CTAP2 standards that use device biometrics, PINs, or patterns for authentication. Android announced FIDO2 specifications over USB with PIN support in November 2023, featuring streamlined user experiences with Material3 Design bottomsheets, Credential Manager APIs for easier developer integration, and secure PIN protocol algorithms that avoid storing actual PINs on devices or security keys. Google plans continued FIDO enhancements, including NFC support, native credential management for physical security keys, and post-quantum cryptographic algorithms to ensure passkey security remains robust against emerging threats like quantum computers.