Compromised credentials? Google can now change website passwords for you

  • Your password is bad—want us to change it?

  • Changing password…

  • Here’s a GIF of all this in action.

Google has taught the Google Assistant a fun new trick: it can now change your website passwords for you.

We’ll still need to see how this feature works in the real world, but Google’s demo says you’ll be able to tap a single button to have Google register a new password with whatever site you’re on.

Google is combining a few puzzle pieces to make this happen. Google Password Manager has long been able to store your passwords thanks to integration into Chrome and Android. It has also been able to generate secure passwords, making it easy to register a new account. Google scans your credentials against a big list of compromised usernames and passwords every time you log in, and if it detects bad credentials, the “Check Password” screen will pop up. In the past, this screen has left the next steps up to you, but a “change password” button from the Google Assistant will now appear on supported sites.

In 2019, the Google Assistant learned how to navigate webpages via a feature called “Duplex on the web.” A progress card slides up from the bottom of the screen, and Duplex on the web scrolls through webpages, taps on buttons, and pastes in form data. Previously, you could use the feature to buy movie tickets, and now it will change your password and save the new, auto-generated password in the Google Password Manager. That’s all assuming nothing goes wrong.

The big catch here is that the automatic password changing will only work on “supported sites,” so if the website has a particularly strange layout, the feature won’t work. Duplex on the web does all the navigating right in front of you, so you’ll be able to watch the process and stop it if anything goes wrong. Google says that “automated password changes are rolling out gradually in Chrome on Android, to users who sync their passwords.” Support for new websites will be added as time goes on, and the feature will be out first in the US and will come to “more countries in the coming months.”

https://arstechnica.com/?p=1765557