Google Introduces ‘Restore Credentials’ Feature for Secure App Access on New Android Devices

Google Rolls Out ‘Restore Credentials’ Feature to Simplify Account Recovery on New Android Devices

Nov 25, 2024 | Ravie Lakshmanan | Mobile Security / Privacy

In a significant enhancement to user privacy and convenience, Google has unveiled a new feature dubbed "Restore Credentials," set to revolutionize how users regain access to their accounts on third-party apps when transitioning to new Android devices. As part of Android’s Credential Manager API, this innovative tool aims to eliminate the tedious process of manually re-entering login credentials after a device upgrade.

According to Google’s Neelansh Sahai, "With Restore Credentials, apps can seamlessly onboard users to their accounts on a new device after they restore their apps and data." This functionality operates automatically in the background, streamlining the login process during the app restoration phase and requiring no additional user interaction.

At the core of this feature is a secure mechanism called a restore key, designed in accordance with FIDO2 standards, which employs public key encryption. When users sign in to supporting apps, their restore keys are saved locally and encrypted on their devices. If users opt for cloud backup, these keys can also be securely stored in the cloud.

This enhancement allows for an effortless transition to new devices. As users restore apps, these encrypted restore keys can prompt automatic sign-ins—bypassing the frustration of forgotten passwords. However, developers are cautioned to promptly delete restore keys upon user sign-out to prevent unintentional re-logins.

While Google joins the ranks of Apple, which has had a similar feature within its iOS Keychain, these developments coincide with the first Developer Preview of Android 16, highlighting the tech giant’s ongoing commitment to bolstering security and user privacy across its platform. As security threats evolve, such proactive measures are essential in safeguarding user credentials.