Slashdot Mirror
Google's $50 Titan Security Keys Are Now Available in the US (engadget.com)
Last month, Google introduced its Titan Key -- a physical security key used for two-factor authentication -- and now it's widely available for purchase in the US through company's Google Store. Almost any modern browser and mobile device, as well as services such as Dropbox, Twitter, Facebook, Salesforce, Stripe support the Titan Key. It's Google's take on a Fast Identity Online key, a physical device used to authenticate logins over Bluetooth. From a report: For $50, you'll get a USB security key and a Bluetooth security key as well as a USB-C to USB-A adapter and a USB-C to USB-A connecting cable. What happens if you lose them? From a report: A downside of physical keys is that if lose them, you're toast. That's why you have two keys -- one is meant to be a backup. Google says it can help you gain access to your account again but the recovery process can take days. VentureBeat adds: It's not meant to compete with other FIDO keys on the market, stressed Sam Srinivas, product management director for information security at Google, during a press pre-briefing. Rather, it's "for customers who want security keys and trust Google," he said. Further reading: None of Google's 85,000 Employees Have Been Phished in More Than a Year After Company Required Them to Use Physical Security Keys For 2FA.
Am I missing something? Is there a full article? Who supports this? Amazon? Shopping Sites? Banking or Investment? It seems that more effort could have been put into this post.
None of Google's 85,000 Employees Have Been Phished in More Than a Year After Company Required Them to Use Physical Security Keys For 2FA
How many of them using 2FA and NOT using physical keys got phished?
Getting phished for the password sure - but who gives out the 2FA code? Even presuming a hacked website I would think the key would just hand over the data to the fake website?
Would you trust Google to make you secure when Google mines details about as many people as it can?
I use Google Authenticator on my phone for my MFA needs. I think I'm more likely to notice my phone going missing than I am to notice a small usb key going missing, and I'm also more likely to remember to bring my phone wherever I'm going.
So I think I'll just stick with using my phone and save the $50.
or his pals at the nsa?
These Titan keys are the same hardware as the Feitian FIDO keys, but supposedly with a custom firmware so not a simple rebranding.
I'm curious to know how these compare.
Seriously, who cares? Who trusts Google, a company that makes all of its money by spying on the users of its platform, with anything that has to do with security? Their whole business model is based around taking your data. I would trust it more if it was a product of the NSA or CIA.
Before, if they didn't get to me by phishing they were bust.
Now they have to come to my home and hit me over the head with a wrench and take my titan-dongle.
Did what? Learn how to color the flag properly? The suspense is killing me!
it's "for customers who want security keys and trust Google
It doesn't seem like anyone there ran through the Venn diagram on that one, because I come up with approximately zero customers...
And that includes Google employees.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
How is this different from the $5 RSA keys?
Don't allow anyone else to be evil!
1) "A downside of physical keys is that if lose them, you're toast." Bullshit. I use Yubikey and if I lose it I simply use the backup alpanumeric codes I created when I established the 2FA account on the site.
2) You're gonna trust Google?
If you actually want a 2FA you would probably have enabled it with your phone or possibly a physical key device (similar to this one). However this is a Bluetooth device and we all know how secure that is.
Why support a superior product when you can just delay them and roll your own shittier version?
Why does the "and now it's widely available for purchase in the US through company's Google Store" link go to an engadget article instead of the fucking Google Store?
To use a hardware token as 2FA on FaceBook, Twitter, DropBox and so on, YOU FIRST HAVE TO ENABLE 2FA VIA SMS.
AFTER THEY HAVE FUCKING COLLECTED YOUR PHONE NUMBER, THEN AND ONLY THEN WILL HARDWARE TOKEN 2FA BE AVAILABLE AS AN OPTION.
WHAT THE FUCK?
Reading Exhibit 2 of the Damore lawsuit against Google pretty much deflated my assessment of Google's ability to professionally handle sensitive data. Every organization has its politics, but I've never seen anything like that before.
Overpay for a U2F key, AND lend your trust to Google. Brilliant strategy.
as nice as it sounds to be more secure, I would lose it within a week. me iz gettin old and tend to misplace things a lot :-(
That's the most impressive part of the announcement, if you ask me. Their store page says that they have a "USB-C to USB-A adapter", which is nothing special, but also a "Micro USB-C to USB-A connecting cable".
I'm eager to hear when this new "Micro USB-C" connector will start appearing on Android phones and tablets.
I would trust them long before I would trust Google. The FSF/GNU would at least make it a specification to be available on multiple platforms.
How can they be secure if Google can restore access even if it takes days? Doesn't that mean Google can restore access for someone else?