Google augments authentication with USB key
Google has amped up its two-factor authentication capabilities, introducing a method based on a physical USB key.
The company has introduced Security Key, a verification method that promises to be more secure than the default code-based system.
“With 2-Step Verification ... sophisticated attackers could sometimes set up lookalike sites that ask you to provide your verification codes to them, instead of Google,” the company said in an FAQ about the new product.
Security Key is instead designed to analyse unique cryptographic signatures in order to only work when a login page is a Google site, and not a spoof.
The key works without a mobile data connection or batteries. It currently only supports Google’s own web browser Chrome.
Security Key uses the FIDO Alliance’s Universal 2nd Factor (U2F) protocol, so other website operators can add compatibility with the key by using the protocol.
The USB keys must be purchased from participating U2F vendors. If they are lost, users can fall back on alternative methods such as code-based verification.
The keys do not store identifying information, so criminals would not be able to trace them back to their owners’ systems. But they are able to answer a challenge from an account they have previously been registered to.
Australia's biggest cyber breaches aren't hacks, they're access failures
The largest cyber breaches have rarely been sophisticated and were often preventable.
Cyber lessons from 2025: why human risk will define 2026
Success in 2026 will come from building security into the rhythm of business, where technology,...
2026 will be the year identity defines cyber defence
2025 gave us an initial look at what happens when AI scales faster than identity controls.
