How is Google preventing its employees from getting hacked? By using some hardware anyone can buy: USB security keys.
In 2017, the company began giving out physical security keys to all 85,000 employees. And since then, no employees have reported any confirmed takeovers of work-related accounts, Google said on Monday.
The news, which was first reported by the security journalist Brian Krebs, highlights how a physical security key can prevent your online accounts from getting breached. Simply protecting your account with a password often isn't enough. Hackers can sometimes guess them, or they can use a phishing email to trick you into giving them up.
However, a security key offers a level of protection that can stymie the best hackers from infiltrating your accounts. It works like this: Any computer that attempts to log in will need both the password and the physical key.
Security experts call this setup two-factor authentication, in which you need both the password and another piece of information to access the account. The biggest internet services, such as Google, Facebook and Twitter, actually already offer this security solution and you can use it now for free.
The only difference is that this two-factor authentication is generally used with a password and a special code that is generated over your smartphone. Trying to hack someone with this security setup isn't easy, but it can still be done.
Imagine a hacker who has your phone number. He could try to trick you into giving up the special one-time codes generated over you smartphone. Other hackers have managed to crack two-factor authentication by spying over a cellular network and intercepting the SMS messages loaded with the special codes.
A physical security key solves this problem by introducing actual hardware into the equation. Password and special codes are all digital, making them easy to send and replicate. A USB security key, on the other hand, isn't. To break into your account, a hacker has to not only know your password, but personally come and steal your security key from you. This probably explains why Google employees have been so hard to phish.
If you're in the market for a security key, the most popular manufacturer of them is Yubico, which offers them starting at $20. The more expensive models can be used to connect with a smartphone or a USB-C port.
Not every site supports USB security keys, but the biggest services including Google, Facebook, Dropbox and most recently Twitter do. The whole tech industry is also working to roll out new login standards that'll help make support for the keys universally accepted.
If you're on a budget, using two-factor authentication is still recommended. But it's a good idea to generate the special codes you'll receive through an authenticator app, instead of via SMS messages.