Google Expands 2-Factor Authentication For Chrome, GmailGoogle Expands 2-Factor Authentication For Chrome, Gmail
Google issues USB keys for Chrome users to log into Google accounts and any other websites that support FIDO universal two-factor authentication -- but it's no help to mobile users.
October 22, 2014
Google today expanded two-factor authentication (2FA) for Google account users and opened the door for other websites to offer 2FA to customers who visit their sites through Google Chrome.
Google launched support for Security Key, making Chrome the first browser to implement support for Fast Identity Online (FIDO) Universal Two-Factor (U2F) Authentication -- an open-source standard that lets users log in with a password and a variety of physical devices. Those devices may include USB keys, Bluetooth devices, NFC, biometrics, and smartcards, but for now Google only supports USB keys that are "FIDO-ready."
Google will continue to offer Google account holders its existing two-factor authentication method, in which a user manually enters a six-digit code sent to their mobile phone. However, as the company explains:
...sophisticated attackers could set up lookalike sites that ask you to provide your verification codes to them, instead of Google. Security Key offers better protection against this kind of attack, because it uses cryptography instead of verification codes and automatically works only with the website it's supposed to work with.
The drawback of Security Key, of course, is that it only works on devices that have USB ports -- thereby counting out most mobile phones and Apple devices.
Several companies recently released new lines of FIDO-ready devices -- including Duo Security, Entersekt, Infineon, NXP, Nok Nok Labs, Plug-up International, ST Microelectronics, Sonavation, StrongAuth, SurePassID, and Yubico.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
What Ransomware Groups Look for in Enterprise Victims
How to Use Threat Intelligence to Mitigate Third-Party Risk
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware