Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Identity & Access

Google Offers Added Account Protection With ‘Security Key’

Google on Tuesday announced the introduction of Security Key, a physical USB second factor that’s designed to provide an extra layer of protection to user accounts.

Google on Tuesday announced the introduction of Security Key, a physical USB second factor that’s designed to provide an extra layer of protection to user accounts.

Up until now, Google users could enhance the security of their accounts by enabling 2-step verification. This feature prevents unauthorized access to accounts by requiring both the password and a one-time verification code sent to the user’s mobile phone.

While this makes it much more difficult to compromise an account, a clever malicious actor could still gain access by setting up a phishing website that requests the verification code. Google introduced Security Key to protect users against such attacks.

Google Security Key USB DeviceSecurity Key is easy to use. Customers must first acquire a USB device that is compliant with FIDO Universal 2nd Factor (U2F), an open authentication standard maintained by the FIDO Alliance. Then, all they need to do is add a Security Key to their account.

When they attempt to log in to their accounts from Google Chrome, user must connect the USB device to the computer and tap it when prompted in the Web browser. The advantage of using Security Key is that it relies on a cryptographic signature and it only works with the genuine Google websites so it is not vulnerable to phishing attacks.

According to Google, Security Key works with Chrome 38 or newer on Chrome OS, Windows, Mac and Linux devices. Since mobile phones and tablets don’t have USB ports, Security Key is not recommended for mobile-only users. For the time being, Chrome is the only supported browser, but Google hopes other companies will add FIDO U2F support to their browsers.

 Google has clarified that the same Security Key can be used for multiple accounts, and multiple Security Keys can be used for a single account. When customers try to access their accounts from a device or browser that doesn’t support Security Key, they will be given the option to use a verification code sent to their mobile phone.

In case the Security Key USB device is lost, users can simply access their accounts with a verification code and then remove the Security Key. In the event of loss or theft, users don’t have to worry about their information being compromised because the Security Key doesn’t store any account data, Google said.

“We congratulate Google for making FIDO U2F authentication an option for their users,” commented Michael Barrett, president of the FIDO Alliance. “With large scale deployments of FIDO UAF in payments applications from PayPal, Samsung, AliPay, Nok Nok Labs, and Synaptics, and today’s announcement of FIDO U2F authentication by Google, there is no doubt that a new era has arrived. We are starting to move users and providers alike beyond single-factor passwords to more secure, private, easy-to-use FIDO authentication.”

Advertisement. Scroll to continue reading.

In addition to Google, cloud-based two-factor authentication services provider Duo Security announced on Tuesday that their FIDO Ready  products now support the U2F specifications.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Compliance

Government agencies in the United States have made progress in the implementation of the DMARC standard in response to a Department of Homeland Security...

Email Security

Many Fortune 500, FTSE 100 and ASX 100 companies have failed to properly implement the DMARC standard, exposing their customers and partners to phishing...

Funding/M&A

The private equity firm merges the newly acquired ForgeRock with Ping Identity, combining two of the biggest names in enterprise IAM market.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...