The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.

Android can now help you swap password managers

A password manager is a piece of software that helps users create and store long, unique, and random passwords. This will help avoid password reuse, so that if one of your passwords is ever compromised, attackers cannot use it in more than one place, effectively isolating the damage.

In a blog post, Google announced a tool that will assist Android users in moving their credentials from one password manager to another. With most password managers, you can export your credentials and import them into an alternative, typically through a .csv file — the kind you might open with a standard spreadsheet application. Google’s new feature instead detects the password manager on your device, and offers the ability to export and import credentials into a new password manager.

As you might imagine, this would help users get started with Google Password Manager. But it also supports switching to and from 1Password, Bitwarden, and Dashlane, and potentially more down the road.

What you can do

This new feature uses the Credential Exchange Format, which is pushed by the FIDO Alliance, a coalition of technology industry actors focused on standardizing stronger authentication on the web. This means that it’s basically an on-device file that can be confidentially piped into a supported application on your device.

  • Looking to switch password managers? You can try this feature by simply opening one of the supported password manager apps. You will be able to import your credentials from another password manager during setup. While we don’t recommend using Google Password Manager, we do recommend 1Password, Bitwarden, or Dashlane. These are all platform-agnostic, so you can use them on every major operating system and web browser. Read our guide to choosing a password manager.
  • Learn all about passkeys. The new tool also enables transferring passkeys, which you may have seen in recent months. A passkey is essentially a credential that is tied to your device. Every now and again, you may log in to a website that offers to save a passkey on your device, which effectively lets you sign on without a traditional username and password. We’re generally pro-passkey, but you’ll want to be careful where you save them, because it’s possible to have your passkeys stored in various places. I personally try to keep them saved in my password manager as consistently as I can. Read our guide to passkeys.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,
Martin

–

Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation