NewsDecember 28, 2016 @ 7:45 AM

Google Is Ga-Ga Over Security Key

Most systems require users to provide verification of their identities to log in. This is usually done with passwords that serve as a security key.

With Authentication, More Is More

Some situations call for two-factor authentication (2FA). That means that the system sends the user information and then requires the user to repeat it. Just how that information gets sent and repeated, however, has been under discussion for a while.

One-time passcodes (OTP) have traditionally done the trick. The system typically sends a six- or eight-digit code via short messaging service (SMS) to a phone. Then the user reads the message on the phone and re-enters it into a computer — if the message isn’t intercepted, that is.

The system could also send the OTP to a cryptographically aware dongle or smartcard. This usually requires drivers and other hardware, however, meaning that there is no guarantee a smartcard can be read by all the different machines in a network. Without the generated response from the device, logging in is impossible.

The Security Key Is Key to Security

Over the past two years, Ars Technica reported, Google has tried using a USB device called Security Key to help it go down the dongle-style cryptographic path without incurring the overhead of smartcard readers or drivers. Google’s engineers assumed that USB ports are ubiquitous.

The tech giant launched a study of 50,000 users and determined that this device is particularly well-suited for 2FA. The devices range in unit cost from $6 to $18, far below the total cost of ownership of a smartcard solution. The Security Key generates a “cryptographic assertion,” which is used for the additional authentication.

These devices are functionally based on the Universal Second Factor (U2F) protocol. While adoption of this protocol is far from universal, it appears that Google, Dropbox, GitHub and other major sites have implemented it to some degree. Chrome, Opera and Firefox browsers are also able to use it.

If you operate on Chromebooks exclusively, the Security Key may be able to provide some immediate benefits in 2FA situations. For a wider user experience, however, the underlying U2F protocol will be unreliable until it gains mainstream acceptance.

Share this Article:
Larry Loeb

Principal, PBC Enterprises

Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He wrote for IBM's DeveloperWorks site for seven years and has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange.