Google updates its login system with support for FIDO2, allowing users to log into its services with hardware security keys on Firefox and Edge
Google has updated its support for hardware security keys so you no longer need to rely on its Chrome browser to log into websites like Gmail, YouTube and G Suite. Tweets: @christiaanbrand , @christiaanbrand , and @stshank Tweets: Christiaan Brand / @christiaanbrand : Security key support during login for @google accounts now transitioned from U2F to WebAuthn. This means Google users using SKs can now sign in on Edge and FireFox too! @FIDOAlliance Christiaan Brand / @christiaanbrand : Yep. I very deliberately said “login”. It'll still take some time to support registration, but right now, if you happen to have a registered key, you can use it where webauthn is supported. Stephen Shankland / @stshank : Google just modernized its security key support with support for FIDO2 and WebAuthn standards. Today that means Firefox and Edge browsers can use the keys. Tomorrow, maybe we'll be able to ditch passwords altogether. http://www.cnet.com/...
Context & Ripple Effects
This is the payoff of a two-year standards push: after the FIDO Alliance and W3C announced WebAuthn as an open standard for password-free logins in 2018, Microsoft moved first by letting Windows 10 users sign into Microsoft Accounts with standards-based FIDO2 security keys. Google's update closes its own gap — until now, hardware-key logins for Gmail, YouTube, and G Suite only worked through Chrome because Google's implementation ran on the older U2F protocol.
First-order effects
- Firefox and Edge users with hardware security keys can now authenticate to Google accounts without switching to Chrome; per Christiaan Brand's note, this covers login only, with registration still to come.
- Google's authentication stack shifts from proprietary U2F to the WebAuthn standard, aligning it with what Microsoft already shipped for Microsoft Accounts.
Second-order effects
- With both major non-Chromium-adjacent browsers covered, web services that still gate security-key login behind Chrome face pressure to adopt WebAuthn or look like the laggard.
- Google extending key-based auth beyond its own browser — weeks before letting any Android 7.0+ phone act as a security key for two-factor authentication — widens the addressable base for FIDO2 key vendors beyond Chrome loyalists.
Third-order effects
- The sequence here — open standard, then Microsoft, then Google, then OpenSK as an open-source key implementation — points toward authentication decoupling from any single vendor's browser entirely, which is the road that ends at Google enabling passkeys on all accounts in 2023.
The trend: Browser-vendor lock-in on strong authentication is dissolving as FIDO2/WebAuthn becomes the shared substrate, setting up the industry-wide move from passwords to passkeys.