Google Simplifies Password and Passkey Migration on Android
New system enables seamless transfer between password managers.
1Password Transfer Challenges
Previously, switching password managers on Android required downloading passwords into an unencrypted text file, exposing them briefly. Passkeys couldn't be transferred at all due to their cryptographic nature, forcing users to recreate them manually across every site and app. This process was both time-consuming and insecure.
2New Transfer System
Google introduced a new transfer experience built into Android, allowing users to move passwords and passkeys between password managers without downloading files. Android acts as a secure intermediary, ensuring credentials never touch an exposed file format during the process. This enhances both security and convenience.
3How It Works
When users open their new password manager and select the import option, Android detects existing password managers on the device and presents them as transfer sources. Users tap through to their current manager, select credentials to move, review them, and authorize the transfer. The process completes in seconds.
4Credential Exchange Protocol
The technology behind this system is the Credential Exchange Protocol (CXP), finalized by the FIDO Alliance. CXP ensures secure credential transfer through an encrypted temporary file, bypassing Android's standard data channel, which has size limitations that could expose credentials if exceeded.
5Supported Credentials
The new transfer system supports passkeys, addresses, credit cards, SSH keys, Wi-Fi passwords, two-factor authentication secrets, secure notes, and API keys, provided both apps support them. This broad compatibility makes it a versatile solution for credential management.
6Current Limitations
Currently, the feature is limited to Google Password Manager, 1Password, Bitwarden, and Dashlane. Both sending and receiving apps must support the new protocol for the transfer to work. Users need to ensure their password managers are fully updated to use this feature.
7Fallback Method
If a user's current password manager doesn't appear as a source option, the feature isn't available from that app yet. In such cases, users must resort to the old CSV method for transferring credentials, which is less secure and more cumbersome.
8Importance of the Update
This update significantly improves the security and ease of switching password managers on Android. By eliminating the need for unencrypted files and manual passkey recreation, Google addresses critical vulnerabilities in the credential transfer process, enhancing user experience and data protection.
Original article: TalkAndroid — Google Simplifies Password and Passkey Migration on Android