Google has long been trying to convince users to enable two-step verification to improve the security of their accounts. The traditional procedure requires a mobile device, but there is another option: the USB key. Google enabled support for USB keys in October 2014, and after more than two years of internal testing, the company concluded that they are superior to other similar solutions.
Protecting our accounts is critical, but information security, or rather, the “good” information security, requires parameters not all users are willing to follow. Thus we find easy and repeated passwords, sessions left open on unknown computers, handling of sensitive data on unencrypted networks, and a long etcetera. A good strategy to improve this situation is enabling two-step verification. If you have a mobile phone, you can receive additional codes via text message, and if you have a compatible smartphone, you can generate codes with a local app (assuming the service offers it in the first place). However, Google is convinced something superior exists, and it is a classic concept: the USB key.
The study
Google developed a study that spanned more than two years and reached 50,000 employees to evaluate the usefulness and robustness of USB keys against other two-step verification methods, such as the aforementioned smartphones, and smart cards. The keys are based on the open standard USF (Universal Second Factor), which is receiving increasingly broad support from third parties (Google, Opera, Dropbox, GitHub, and Mozilla via an extension appear at the top of the list). And their results placed USB keys above the rest.
Mobile devices can be compromised with the help of malware, run out of battery or signal, and conventional text messages are not encrypted. On the other hand, smart cards require special readers and drivers that guarantee their functioning in certain environments.
In contrast, USB keys connect to any available port, do not require external power, their cryptographic signatures are extremely robust, they have a fairly low price (from nine euros), can be carried like an extra key, and most importantly: they are a complement. No protection method is perfect, therefore we must try to place all possible barriers in the way, and according to Google, USB keys are among the best.
