Google Fights Phishing Scams using USB Key

Google says it's suffered zero phishing attacks since it started making staff use a physical key to log in to work accounts. Of course, it's possible it's been hit with attacks it doesn't know about.

The measures were taken to prevent against phishing attacks in which scammers try to trick victims into following a link and opening a bogus website that appears to be from a legitimate organization. The idea is that they then type in login details which the scammers can use to access their account on the real website.

This can be particularly problematic with business accounts that may house emails or messages with confidential information. Big businesses with a lot of employees can offer scammers numerous ways in, providing the scam is successful.

Two-Factor Authentication In Use

The Google security measure is an example of two-factor authentication. That refers to a security check that requires two different ways to prove identity, often described as "something you have and something you know." Usually this means knowing a password and having access to a physical item such as a cellphone.

Many online services trigger two factor authentication when somebody attempts to login from an unfamiliar device or location, rather than using it every time somebody accesses an account. This setup aims to balance convenience and security.

Google previously used cellphone text messages with security codes for two factor authentication for its employees when they accessed work accounts. However, last year it decided all staff must use a physical security key.

Key Not Always Required

The key is a tiny device that plugs into a USB socket. Users logging into their account must type in their password, then plug the key in and press a button. The idea is that this is convenient enough that it can be used more regularly. The theory is that a scammer who got hold of an employee password couldn't use it without the key, while somebody who stole or found the key couldn't use it without the password. (Source: businessinsider.com)

Google staff don't currently have to use the key for every login. The company told security blogger Brian Krebs that "Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time." (Source: krebsonsecurity.com)

What's Your Opinion?

Have you used two-factor authentication? Would you be happy to use a security key to log in to a work account? Could such a set-up lead to people becoming complacent about security?