U2F Security Keys May Be the World's Best Hope Against Account Takeovers (arstechnica.com)

earlytime writes: Large scale account hacks such as the billion user Yahoo breach and targeted phishing hacks of gmail accounts during the U.S. election have made 2016 an infamous year for web security. Along comes U2F/web-security keys to address these issues at a critical time. Ars Technica reports that U2F keys "may be the world's best hope against account takeovers": "The Security Keys are based on Universal Second Factor, an open standard that's easy for end users to use and straightforward for engineers to stitch into hardware and websites. When plugged into a standard USB port, the keys provide a 'cryptographic assertion' that's just about impossible for attackers to guess or phish. Accounts can require that cryptographic key in addition to a normal user password when users log in. Google, Dropbox, GitHub, and other sites have already implemented the standard into their platforms. After more than two years of public implementation and internal study, Google security architects have declared Security Keys their preferred form of two-factor authentication. The architects based their assessment on the ease of using and deploying keys, the security it provided against phishing and other types of password attacks, and the lack of privacy trade-offs that accompany some other forms of two-factor authentication."

The researchers wrote in a recently published report: "We have shipped support for Security Keys in the Chrome browser, have deployed it within Google's internal sign-in system, and have enabled Security Keys as an available second factor in Google's Web services. In this work, we demonstrate that Security Keys lead to both an increased level of security and user satisfaction as well as cheaper support cost."

Comments

Lol, oh really?

[JustAnotherOldGuy]

"the keys provide a 'cryptographic assertion' that's just about impossible for attackers to guess or phish."

Do you know how many times we've heard this kind of claim in the past?

I'd love for it to be true this time but I'm not going to hold my breath.

Re:How is this better than "phone app" 2FA

[Anonymous Coward]

Because it does not require me to have a "smartphone". That's how it is better.

Re:Put your money where your mouth is

[drinkypoo]

You are aware that RSA sold all of the SecureID keys to the NSA so that token is useless, right?

It's useless for hiding your activity from the feds, but it's fine for banking or anything else that's going to be reported to the feds anyway.