Most security experts agree that you should secure all your online accounts with two-step verification when you can. It’s an important additional security feature that requires you to have access to a physical item (typically, a mobile phone) to gain access to your online accounts. After entering your password, you enter a second code from your smartphone to double verify your identity. With two-step verification enabled, even if someone steals your current password through a hack, they won’t be able to enter your accounts unless they also steal that physical item – a requirement that stops most bad guys in their tracks.
Of course, there are always situations where you may not want to use – or simply don’t have access to – a mobile phone. That’s why Google today announced the launch of Security Key. It enables two-step authentication for your Google accounts through the use of a physical USB stick.
“Security Key is a physical USB second factor that only works after verifying the login site is truly a Google website, not a fake site pretending to be Google,” the company explains on its official UK blog. “Rather than typing a code, just insert Security Key into your computer’s USB port and tap it when prompted in Chrome. When you sign into your Google Account using Chrome and Security Key, you can be sure that the cryptographic signature cannot be phished.”
Security Key requires a USB drive to work, so it’s not compatible with most mobile phones and tablets. Security Key also requires you to use the Chrome browser (version 38 or newer) to complete verification. And, of course, there are questions about just how secure the USB format is in general due to the recently discovered BadUSB vulnerability.
If you want to give Security Key a try, you’ll need to purchase a FIDO U2F-certified key to use with the feature. You can buy a basic USB security key on Amazon for $5.99, or something slightly sturdier with a button for $17.99. You can learn how to register and add a Security Key to your Google account by visiting the Google Help page.
