Google now lets Advanced Protection Program users set up with a single passkey, using Android or iOS biometric authentication, instead of two physical keys
Google has made it a little easier for those at more risk of targeted online attacks to enroll in its Advanced Protection Program for Google accounts.
Context & Ripple Effects
Google’s high-risk account program was originally built around hardware-key logins, as shown by its 2017 launch for high-risk users. The new enrollment option lowers a central adoption hurdle without changing the program’s focus on stronger account security.
The move follows Google’s broader passkey rollout: it said in May that more than 400 million accounts had used passkeys. Advanced Protection is therefore becoming a test case for applying that authentication method to users with the greatest exposure to targeted attacks.
First-order effects
- Advanced Protection Program users can enroll using one passkey authenticated through Android or iOS biometrics, rather than obtaining and registering two physical security keys.
- Google reduces setup friction for a security tier aimed at users facing elevated account-takeover risk, while keeping enrollment tied to a phishing-resistant credential.
Second-order effects
- The change raises the usability benchmark for other high-security account offerings that still depend on dedicated hardware tokens at setup.
- Mobile operating systems and passkey ecosystems become more important distribution points for high-assurance account protection, because the device credential now substitutes for a separate physical-key requirement.
Third-order effects
- If high-risk programs continue to accept passkeys, account security may shift from specialized hardware-token deployment toward device-based, phishing-resistant authentication with recovery and device-management controls becoming the key differentiators.
- The trade-off will be whether simplified enrollment broadens adoption without weakening the resilience that made hardware-key requirements attractive for targeted-attack scenarios.
The trend: High-assurance account protection is moving from dedicated physical keys toward passkeys embedded in users’ everyday devices.