We’re taking on a question that I’ve been curious about for some time — not that I’m never not curious about your questions, but this one is a topic that’s bounced around my head a bit, because I am lazy and I hate fussing with password management whenever possible.
Lifehacker reader Kenan writes:
“First of all, thanks for the helpful articles on lifehacker. Keep up the good work! I have a problem and I couldn’t find any solution so far.
I bought this Microsoft keyboard, which has a built-in fingerprint button, for my windows PC. It would be a very cool feature if I could use this button for logins to websites in Google Chrome. But I couldn’t find anything on the Chrome Web Store. I am just using it to login to my Computer at the moment. If there is an add-on in google chrome or a software that could do this that would be nice.”
First, even though I’m rocking a light-up mechanical keyboard that I love, I’m envious of your keyboard’s fingerprint button. I’ve only really played around with biometric authentication on my MacBook, and it’s absurdly convenient to to tap your finger to approve or authenticate into a website or app versus typing in an account name and password (or whatever), even if this is a “fad” most smartphone users have known about since 2013.
On paper, you’re completely correct about the process. You should be able to use your keyboard’s built-in fingerprint scanner to log into websites and Windows alike. Mozilla started rolling out support for this in Firefox 60 early last year, followed by Microsoft Edge and Google Chrome shortly after.
The problem with this passwordless dream is that websites first have to support the FIDO2 protocol for fingerprint authentication to work. And even then, I can’t think of a lot of major sites that let you authenticate in—via the browser—using only your fingerprint. (Admittedly, the website isn’t verifying your fingerprint; the device is, then sending along the message that you are who you say you are.)
My point is more that you have to initially register your device with a site or a service in order to use passwordless authentication, and I can think of many sites that support fingerprint readers (or Windows Hello). You can get into your Microsoft account using Windows Hello (via Edge), but I don’t see a similar option for a Google account. A security key, sure, but not a fingerprint reader. That’s just one example, but the same can be said about Twitter, Facebook, my online bank, my credit card company, et cetera.
Rather than listing out websites and services that do or don’t support fingerprint authentication, I have an alternate proposal. Consider using a password manager like 1Password or LastPass, if you aren’t already. You can set up both services to use fingerprint authentication, which makes it even faster to paste your login credentials into a site.
I remember all the hubbub when Apple first announced Face ID back in September of 2017. There were countless articles and thought pieces criticising Apple for the terrible experience its new security technique was about to create. Instead of just pressing on your iPhone’s Home button, a natural task as you pull your iPhone out of your pants pocket, jacket, or bag, you’d have to pull your device up to eye level, stare at it, and then go about using it as normal.
Don’t go and change your original password for your password manager to something wild and impossible to remember, however, as you’ll still need to use it from time to time to log into your account (after restarting your PC, for example). Once you’ve done that, you can re-authenticate into either service using your fingerprint whenever you need to summon a password into a web form.
While this isn’t the true “login using only my fingerprint” kind of a setup you probably have in mind, it’s a good alternative while we wait for everyone to kill passwords for good—or, at the very least, provide the complementary option of a biometric login.