Google releases USB security key for two-factor authentication

But the new device only works via the Chrome web browser, with no support for smartphones and tablets

Google has announced a physical USB Security Key that should ensure users keep their accounts safe from hackers, although it is not without its limitations.

Anyone who buys a compatible USB from a third-party supplier and adds the Security Key functionality will be able to use it when logging in to Google’s sites, which include Gmail and Google Drive, as it will hold the code required when two-factor authentication has been switched on.

Two-factor authentication is a security protection that asks for a password and an additional piece of information that verifies the identity of the person logging in.

Previously, Google has only allowed users to receive the second chunk of authentication data as a code sent via text message or the Authenticator app, but the USB can now be used without any input needed on the keyboard.

Unless hackers manage to steal the plastic key, accounts with Security Key enabled will almost certainly be secure from compromise. This should be more secure than using a smartphone too, as cyber criminals have infected mobile devices in the past to siphon off security codes.

The USB will also check that the site in question is owned by Google and not a fake website set up by a cyber criminal. Security Key won’t transmit its cryptographic signature when a phishing site is attempting to impersonate a Google login page in Chrome.

“Rather than typing a code, just insert Security Key into your computer’s USB port and tap it when prompted in Chrome. When you sign into your Google Account using Chrome and Security Key, you can be sure that the cryptographic signature cannot be phished,” said Nishit Shah, product manager for Google’s security division.

There is one significant limitation: the key only works via the Chrome browser. This will likely prevent many from using it. Then there’s the need for added hardware, which might put some off.

“The downside is that it is one more thing to carry around and keep track off, it requires the Chrome browser to work, and that it requires a USB port to work which makes it useless for a lot of mobile devices,” security researcher Andreas Lindh told the Guardian over email.

“I’m not 100% sure who their target audience is, but perhaps non-technical people who aren’t that comfortable using smartphones and apps will find this appealing. Either way, if it can make more people using two-factor authentication, it is a good thing.”

As part of its announcement, Google is joining and championing a movement known as the FIDO (Fast IDentity Online) Alliance. The group is trying to spread the open Universal 2nd Factor (U2F) protocol, which the Security Key uses, across sites so users only require one USB key for secure access to various web services.

“With large scale deployments of FIDO UAF [Universal Authentication Framework] in payments applications from PayPal, Samsung, AliPay, Nok Nok Labs, and Synaptics, and today’s announcement of FIDO U2F authentication by Google, there is no doubt that a new era has arrived,” said Michael Barrett, president of the FIDO Alliance. “We are starting to move users and providers alike beyond single-factor passwords to more secure, private, easy-to-use FIDO authentication.”

For anyone who wants to get set up with a Security Key, a FIDO-accredited stick can be found here.